chai-as-soul@2.3.6

Analysis

chai-as-soul@2.3.6 is a trojanized pino logging-library clone (combosquat of the "chai" package name) that ships a 4MB obfuscated lib/config.js. On load it beacons host metadata to a remote C2 at 167[.]88[.]167[.]54 (ports 8085/8087): it POSTs JSON containing hostname, OS, and username to /api/log and /api/notify, and uploads a multipart sysinfo.txt file (host, OS, username, platform, timestamp) to /upload. It also performs DNS TXT beaconing. The implant uses axios and a per-request Validation HMAC header.