chai-as-agile@2.4.7

Analysis

On import, the package executes lib/initializeCaller.js, which base64-decodes the endpoint hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df and POSTs the entire process environment (all environment variables and any credentials/tokens they contain) to it. It then takes the HTTP response body and executes it as JavaScript via the Function constructor, enabling arbitrary remote code execution on the host. The exfiltration and code-execution trigger automatically whenever the module is required.