MAL-2026-13958 Malicious code in power-assert-plus (npm)

power-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns node build/power-assert-plus.js. That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to new Function('require', body)(require), executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.