chai-as-attested@6.0.3

Analysis

chai-as-attested is a combosquat package impersonating the chai assertion library. When required, it spawns a detached background child process that fetches and executes remote code from a C2 endpoint. The file lib/initializeCaller.js decodes a base64-embedded URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json) and HTTP header (x-secret-key), makes a GET request to that endpoint, and passes the response body into the Function constructor for arbitrary code execution. The package retries the fetch up to 5 times on failure. The parent process exits independently while the malicious payload runs in the background.