chai-utils-test@4.5.0

Analysis

This combosquat of the Chai test library is a dropper. Its index.js spawns a detached, unref'd background node process running a payload that fetches stage-2 code from hxxp://statecheck[.]ddns[.]net/api/scanner.js via axios using a hardcoded HTTP Basic auth header (base64 YWRtaW46c2VjcmV0MTIz, i.e. admin:secret123), then executes it with new Function("require", s), giving the remote code full require access. The publisher impersonates real Chai maintainers.