express-chai@3.7.9

Analysis

express-chai@3.7.9 is a trojanized clone of the pino logger with an injected remote-code-execution payload. When the package is used as express middleware, lib/caller.js performs an HTTP GET to hxxps://gray-dyane-31[.]tiiny[.]site/index[.]json with header dev-secret-key: _, reads the response's "cookie" field, and executes it as JavaScript via the Function constructor with require in scope, giving the remote server arbitrary code execution inside the installer's process. The C2 URL is base64-encoded in lib/const.js.