chai-as-gateway@7.1.5

Analysis

chai-as-gateway@7.1.5 is a trojanized clone of the pino logger that, when loaded, beacons host metadata to a remote C2 server. It POSTs JSON to hxxp://167[.]88[.]167[.]54:8087/api/log and /api/notify containing a user key, hostname, OS, and username, and POSTs a multipart file named sysinfo.txt to hxxp://167[.]88[.]167[.]54:8085/upload with the hostname, OS, username, platform, and timestamp. The beacon logic is hidden inside a 4.1MB obfuscated lib/config.js (javascript-obfuscator output with hex-escaped method names) so the C2 address is not visible as a literal string. The package impersonates the chai assertion library name while shipping pino's code with the injected beacon.