chai-as-viem@1.1.3

Analysis

chai-as-viem@1.1.3 is a trojanized pino logging library clone. On module load (require of index.js), it executes lib/initializeCaller.js, which base64-decodes the URL hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df and POSTs the entire process.env object (all environment variables, including any API tokens and secrets) to that endpoint with header x-secret-header: secret. It then takes the HTTP response body and executes it as JavaScript via new Function("require", response.data), enabling remote code execution of a second-stage payload. The package exfiltrates the installer's environment and runs attacker-supplied code.