chai-check-error@2.1.3

Analysis

chai-check-error@2.1.3 is a supply-chain attack on the well-known chaijs/check-error package. Published by brendanreilly (not original author Jake Luer). postinstall runs node index.js which, alongside stolen utility functions, calls resolveConfig() at module top-level: decodes base64 'jsonkeeper[.]com/b/JOCBY', fetches JSON, extracts .cookie field, and executes it via new Function('require', ...)(require) — classic second-stage RCE payload dropper. No token-theft markers found, but the remote code execution via jsonkeeper[.]com on install is unambiguous malware.