chai-as-persisted@6.1.9

Analysis

Package chai-as-persisted is a typosquat of the real chai-as-promised assertion library. Its postinstall hook (npm run smoke:pino) executes index.js, which spawns a detached background Node.js child process (lib/initializeCaller.js). That child process decodes a base64-embedded URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json), fetches its content via axios with a hardcoded x-secret-key header, and passes the response body to new Function.constructor("require", ...) — executing arbitrary remote code fetched from a third-party hosting site. The package bundles the real pino logger codebase as camouflage but replaces the entry point with this remote-code-execution loader.