assertion-utils-js@2.4.3

Analysis

assertion-utils-js@2.4.3 is a trojanized clone of the Chai assertion library. On require(), index.js spawns a detached background Node.js process running an obfuscated script (lib/chai/utils/assertion.js). That script performs an HTTP GET to coolblast[.]zapto[.]org:8888/api/x-handler?key=W7qL9!mX2 and executes the returned content as code via new Function(require, body), enabling arbitrary remote code execution. The package has no repository, no lifecycle hooks, and its only purpose is to load the real Chai code as camouflage while the background payload fetcher runs.