chai-as-synced@6.0.3

Analysis

A trojanized clone of the pino logger library that achieves remote code execution when the module is loaded. index.js exports a middleware function that silently spawns a detached Node.js child process running lib/initializeCaller.js. That script decodes three base64-embedded strings to obtain a remote endpoint URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json), sends an HTTP GET request with an authorization header (x-secret-key), receives a code payload from the response, and executes it via the Function constructor with full Node.js require access — enabling arbitrary remote code execution on the installer's machine. The package name is a typosquat variant and its description is unrelated to the actual logger code it ships.