chai-chain-test@1.3.5

Analysis

chai-chain-test@1.3.5 is a remote-code-execution dropper. index.js spawns a detached background process (detached:true, unref'd) running lib/caller.js, which fetches code from hxxps://jsonkeeper[.]com/b/EXSIF via axios and executes it via new Function.constructor("require", body) — giving the attacker full access to Node modules. The jsonkeeper endpoint is attacker-controlled and can serve any payload; the description mismatches the content and the declared deps (axios, sqlite3) enable the fetched payload.