chai-plugin@4.5.2

Analysis

chai-plugin@4.5.2 combosquats the real chai assertion library. The package's main entry point (index.js) spawns a detached, hidden Node.js child process that runs an obfuscated payload (lib/chai/utils/assertion.js). This payload makes an HTTP GET request to a remote URL, downloads a second-stage script, and executes it via new Function(require, ...)(require), giving the attacker arbitrary code execution on the victim's machine. The child process is spawned with detached:true and child.unref() to avoid detection. No install hooks are required — the malware activates immediately when the package is required. The README is a copy of the real chai documentation to appear legitimate.