chai-promised-test@1.3.5

Analysis

chai-promised-test@1.3.5 is a trojanized clone of the pino logger published under a misleading name. Upon require(), the package spawns a detached background Node.js process (stdio:ignore, unref'd) that executes lib/caller.js. This file sends an HTTP GET request to hxxps://jsonkeeper[.]com/b/EXSIF with a custom header x-secret-key: _, reads response.data.cookie from the response, and passes the retrieved string into the Function constructor to execute as arbitrary code with access to the require() function. The remote URL is attacker-controlled and can serve any malicious second-stage payload. The package also suppresses console.log during execution and retries up to 5 times.