chai-as-indexed@6.0.5

Analysis

chai-as-indexed@6.0.5 is a trojanized clone of the pino logger: it ships pino's source tree and documentation but injects a remote-code loader. The exported middleware in index.js spawns a detached, unref'd background process running `node lib/caller.js`. That script base64-decodes a hardcoded endpoint and header credentials from lib/const.js, issues an HTTPS GET with axios to hxxps://tomato-erminie-2[.]tiiny[.]site/index[.]json, reads the `cookie` field of the JSON response, and executes it with `new Function.constructor("require", response)(require)` — arbitrary remote code execution with full require access, retried up to five times. The remote host is a free static-site service used as a throwaway payload host, so the executed second stage is attacker-controlled and can change at any time. The package name impersonates the chai-as-* family while the code is a copy of pino.