chai-as-assured@7.1.2

Analysis

chai-as-assured@7.1.2 is a combosquat of the legitimate chai-as-promised package. Its main entry (lib/chai-as-assured.js) contains an immediately-invoked async function that base64-decodes a remote URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json), fetches its content via axios with a custom HTTP header (x-secret-key), and executes the response as arbitrary JavaScript code via new Function.constructor("require", response), giving the remote payload full access to Node.js require(). The download retries up to 5 times on failure. The package also impersonates the real chai-as-promised author in its metadata.