assertcoreutils@2.3.2

Analysis

assertcoreutils@2.3.2 is a trojanized clone of the Chai assertion library. The package ships the real Chai v4.3.8 source code (chai.js) but replaces the entry point with a custom index.js that, on require(), spawns a detached background Node process. That process runs a heavily obfuscated script (lib/chai/utils/addAssertion.js) which constructs a URL via query parameter, HTTP GETs the response, and executes it through new Function(..., responseBody)(require), achieving arbitrary remote code execution on the installer's machine. The attacker-controlled remote endpoint dictates the full second-stage payload. The package's homepage (assertcoreutilsutils[.]com) is a suspicious lookalike domain with no legitimate content.