chai-as-align@7.1.0

Analysis

chai-as-align is a combosquat of the popular chai assertion library. On require(), it spawns a detached child process that fetches a remote payload from amethyst-lorrin-26[.]tiiny[.]site/index.json and executes it via the Function constructor, enabling arbitrary remote code execution on the installer's machine. The C2 endpoint is contacted with an x-secret-key header. The package has no lifecycle hooks but executes the payload immediately on import via an IIFE in lib/initializeCaller.js.