chai-as-staged@6.0.4

Analysis

Package chai-as-staged@6.0.4 is a combosquat of the real chai-as-promised assertion plugin. It ships a trojanized copy of the pino logger codebase with a remote-code-execution payload in lib/initializeCaller.js. When required and the exported middleware function is called, index.js spawns a detached Node.js child process running lib/initializeCaller.js. That script decodes a hardcoded base64 URL (hxxps://amethyst-lorrin-26[.]tiiny[.]site/index[.]json), fetches the remote resource via axios.get() with a custom HTTP header x-secret-key: _, and executes the response body's 'cookie' field as arbitrary JavaScript code via new Function.constructor("require", ...), granting full access to Node.js modules. The detached spawn (stdio:'ignore', unref()) ensures the payload process outlives the parent. C2: amethyst-lorrin-26[.]tiiny[.]site (HTTPS).