MAL-2026-13954 Malicious code in minimalistic-assert-plus (npm)

The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require('minimalistic-assert-plus'), index.js spawns a detached Node child (spawn('node', [assertion,...], {detached:true, stdio:'ignore'})) that runs lib/chai/utils/expectAssertion.js. That file is heavily obfuscated (obfuscator.io string-array + base64 rotation, hex-named identifiers such as _0x4b784f, _0x51bd34) and at runtime constructs an HTTP URL, performs an http.get, and passes the response body to new Function(..., body)(require) — evaluating attacker-supplied JavaScript with the real Node require in scope. Stdio is ignored and the process is detached to evade observation. Package metadata is deceptive: name mimics minimalistic-assert, description is copied from Chai, and homepage points to minimalistic-assert-plus.com.