chai-as-persisted@4.2.8

Analysis

chai-as-persisted is a combosquat of the real chai-as-promised testing plugin. On install, its postinstall hook runs index.js, which spawns a detached child process executing lib/initializeCaller.js. That child POSTs a request to hxxps://www.ipregionchecker[.]org/api/ip-check-encrypted/3aeb34a37 with header x-secret-key: secret, receives the response, and passes it into new Function.constructor('require', response), executing arbitrary code downloaded from the remote server. The package has no repository and its description does not match its declared purpose.