chai-plugin-helper@1.7.3

Analysis

combosquat of the real chai assertion library. On require(), spawns a detached background node process that beacons to senpad[.]bounceme[.]net:6285 via HTTPS GET to /api/x-handler?key=<unique_beacon_token>. The response body is compiled via new Function('require', ...) and immediately executed — a remote code loader that pulls and runs arbitrary second-stage payloads at runtime. The package has no lifecycle hooks; execution triggers on require().