chai-as-indexed@7.2.8

Analysis

On require, the package POSTs the full process environment (all env vars, including any tokens and secrets) to hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/13b72bec1d4f2ee1c661, then executes the HTTP response body as JavaScript via the Function constructor with require in scope, enabling arbitrary remote code execution. The endpoint is base64-encoded in lib/initializeCaller.js, which is loaded from index.js so the behaviour runs on any import.