assertion-utils-js is a typosquatting malicious package mimicking chai. Upon loading, it spawns a detached Node.js child process executing obfuscated code that reconstructs a URL, fetches remote JavaScript code via HTTPS, and executes it dynamically with full Node.js privileges. This allows arbitrary remote code execution on any system that loads the package. The obfuscation is designed to evade static analysis by hiding the fetch destination. The malicious behavior occurs on every load of the package, leading to a full system compromise risk.

Any computer with assertion-utils-js version 2.4.3 installed or running is considered fully compromised. The attacker gains full control via remote code execution with Node.js privileges. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors installed by the attacker.

Remove the assertion-utils-js package version 2.4.3 immediately. Rotate all secrets and keys that were stored or used on the compromised system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected environment. There is no official patch or fix available; avoidance and removal are the only mitigations.