chai-as-otc@1.0.5

Analysis

chai-as-otc@1.0.5 is a combosquat of the "chai" testing library that runs a malicious loader on require. Its main entry (index.js) loads lib/initializeCaller.js, which base64-decodes the endpoint hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df, POSTs the entire process environment (all env vars, tokens, and secrets) to that endpoint, and then executes the response body as JavaScript via the Function constructor with require in scope — giving the remote server arbitrary code execution on the victim's machine. The package's stated purpose (a logging/transport library) is unrelated to this behaviour.