chain-chai-await@1.3.6

Analysis

chain-chai-await@1.3.6 is a trojanized package masquerading as a logging library (pino clone). On require(), index.js spawns a detached child process running lib/caller.js, which fetches a remote payload from hxxps://jsonkeeper[.]com/b/TJKON (with custom header x-secret-key) and executes the returned 'cookie' value via the Function constructor — a remote-code-execution dropper. The package also ships a base64-encoded variant of the same C2 URL in lib/const.js.