react-check-error@2.1.6

Analysis

react-check-error@2.1.6 is a typosquat of the legitimate check-error utility by the chai.js project. On require(), it decrypts a hardcoded AES-256-CBC ciphertext using a derived key and IV, revealing hxxps://jsonkeeper[.]com/b/JOCBY. It then fetches that URL over HTTPS, extracts the "cookie" field from the JSON response, and passes it to new Function('require', …)(require) to execute arbitrary remote code. DNS queries and HTTPS connections to jsonkeeper[.]com were confirmed at runtime.