The npm package assertion-utils-js is a malicious typosquat of the legitimate chai package. When required, it spawns a detached Node.js child process that runs heavily obfuscated code which fetches and executes remote code with full Node module privileges. This behavior effectively compromises any system running the package. The package version 2.4.3 is affected. Removal of the package does not guarantee full remediation as the system may already be fully compromised.