chai-as-operated@6.0.3

Analysis

Trojanized clone of the pino logger library distributed as the combosquat package 'chai-as-operated'. The package bundles legitimate pino source code as camouflage but injects malicious code in index.js and lib/initializeCaller.js. When the exported middleware function is called, it spawns a detached background Node.js process that decodes a base64-embedded URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json), fetches its contents via HTTP GET with an 'x-secret-key' header, and executes the 'cookie' field of the response as arbitrary JavaScript code via the Function constructor, passing the 'require' function so the payload can use all Node.js modules. This is a remote code execution dropper that retrieves and runs a second-stage payload from a free file-hosting service (tiiny[.]site).