chai-web3-testkit@1.0.1

Analysis

chai-web3-testkit@1.0.1 impersonates a well-known author (uhop/Eugene Lazutkin) but was published by "nathan222" with a throwaway email. The package ships a stream-utility facade that, when the exported chaiPlugin is used, spawns a detached node child process running src/utils/swap.js. That script fetches arbitrary JS code from jsonkeeper[.]com (a pastebin-like host) via axios GET, then executes it with full Node require access using `new Function.constructor("require", s)(require)` — a textbook second-stage payload delivery mechanism. The README fabricates a convincing Web3 testing toolkit description. The payload host is a generic pastebin service with no relation to any legitimate installer. Retry logic (5 attempts) ensures the remote code loads even on transient failures.