chai-as-built@6.0.3

Analysis

chai-as-built@6.0.3 is a trojanized clone of the pino logger that performs remote code execution. When index.js is required, it spawns a detached background Node.js process running lib/initializeCaller.js. That script decodes a base64-embedded endpoint (amethyst-lorrin-26[.]tiiny[.]site/index.json), fetches it via axios with an x-secret-key header, and passes the response's cookie field into new Function.constructor('require', response), executing arbitrary remote code in the context of the victim's process. The payload retries up to 5 times on failure. Only the @6.0.3 version exists; the package name combosquats chai-as-promised to impersonate the chai testing library.