chai-assert-kit@3.8.1

Analysis

This package is a typosquat clone of the popular chai assertion library: it copies the real library files, description, and contributor list, but trojanizes the package entrypoint. When the package is imported, its index.js immediately spawns a hidden, detached background Node process (stdio ignored and unref()d so it survives after the parent exits) running a bundled, heavily obfuscated script. That script (obfuscated with an obfuscator[.]io string-array and a custom base64/percent-decode routine) makes an outbound HTTP GET to a dynamic-DNS command-and-control endpoint at senpad[.]bounceme[.]net on port 6285 (path /api/x-handler), passing a static key and URL-encoded arguments. It reads the HTTP response body and executes it as live JavaScript via new Function(...), invoking it with Node’s require so the downloaded code gains full module access on the victim machine. This is a second-stage remote-code dropper that lets the operator run arbitrary code on any host that installs or imports the package.