chai-as-uphelded@6.11.4

Analysis

chai-as-uphelded is a combosquat package that clones the pino logging library and adds a remote-code-loading implant. When required, index.js spawns a detached background node process (child.unref(), stdio:ignore) executing lib/caller.js. That file fetches arbitrary JavaScript from a hardcoded C2 JSON storage endpoint (api[.]jsonstorage[.]net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a) authenticated with header x-secret-key: X, reads the 'cookie' field from the response, and executes it via new Function.constructor('require', code) — enabling arbitrary remote code execution with full Node.js require access. The C2 endpoint is hosted on a free JSON storage service (jsonstorage[.]net) for easy payload updates.