chai-plugin-kit@5.8.1

Analysis

chai-plugin-kit is a combosquat of the real chai assertion library. Its index.js loads a cloned copy of chai but also spawns a detached background process that executes an obfuscated second-stage loader (lib/chai/utils/addAssertion.js). At require-time, the loader makes an HTTPS GET request to senpad[.]bounceme[.]net:6285/api/x-handler with a key parameter (P$4vNc8!Xy2^Lg7@Tr9), fetches arbitrary code from the C2 server, and executes it via new Function() with the full require() scope. The real chai source code is shipped verbatim as a camouflage layer; the malicious payload is in index.js and lib/chai/utils/addAssertion.js.