chai-as-testkit@2.3.5

Analysis

chai-as-testkit@2.3.5 is a trojanized clone of the pino logger that, when required, spawns a background process executing an obfuscated payload (lib/config.js, ~4MB with \x-escaped string arrays). The payload beacons to C2 host 167[.]88[.]167[.]54 on ports 8085 and 8087, POSTing host metadata (hostname, OS, username, platform) to /api/log and /api/notify, and uploading a sysinfo.txt file via multipart POST to /upload. The collected system information is exfiltrated to the remote host.