chai-utils-test@4.5.3

Analysis

chai-utils-test@4.5.3 is a combosquat of the chai assertion library acting as a multi-stage remote-code-execution dropper. Its index.js spawns a detached background node process (detached:true, child.unref()) running lib/chai_assert.js, which uses axios to fetch remote code from hxxps://statecheck[.]ddns[.]net/api/scanner.js with hardcoded base64 Basic-auth credentials (admin:secret123), then executes it via new Function("require", s) to grant the operator full require access. The publisher impersonates the real Chai maintainers.