chai-await-dom@1.3.7

Analysis

Package chai-await-dom@1.3.7 is a trojanized clone of the pino logging library published under a combosquat name. When loaded (via require or through the package's entry point), it spawns a detached child process that fetches remote JavaScript code from hxxps://jsonkeeper[.]com/b/BPB86 and executes it using new Function with full Node.js require access (require is injected as a parameter). This gives the attacker arbitrary code execution on the installer's machine, with access to all Node modules including filesystem, network, and child_process. The fetched payload URL (jsonkeeper[.]com/b/BPB86) is the download source for the second-stage code.