If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823)
power-assert-plus is a typosquat of power-assert. On every require(), index.js detach-spawns `node build/power-assert-plus.js`. That build file is obfuscator.io-encoded (string-array + custom base64 alphabet) and, after decoding, dynamically requires http/https, GETs a remote URL, and passes the response body to `new Function('require', body)(require)`, executing attacker-controlled JavaScript with Node's require in the installer's process context. The README frames build/power-assert-plus.js as a browserify bundle of the library, but the shipped 4KB payload is a network loader with no assertion library code; the module name, host, and eval sink are all hidden behind the string-array decoder.