chai-test-mocks@1.2.0

Analysis

This package is published as a chai test-mocks plugin but is a multi-stage remote-code-execution dropper. Its matcher files are mostly legitimate chai code copied as cover, while the main export hides a payload behind pino-style logging configuration. When the exported function runs, it spawns a detached, unref-ed Node subprocess so it keeps running independently of the host process. That subprocess issues an HTTPS GET to a remote endpoint (jsonkeeper[.]com/b/HIECD) with a custom x-secret-key header, reads a field named Cookie out of the JSON response, and executes that string as JavaScript via the Function constructor with access to require -- i.e. arbitrary attacker-controlled code with full Node module access. The fetch-and-execute is retried up to five times and temporarily silences console output around the evaluation to reduce visibility.