chai-chain-dom@1.3.7

Analysis

On require(), the package spawns a detached background child process (index.js → lib/caller.js, detached:true, stdio:ignore). The background process fetches a remote payload from hxxps://jsonkeeper[.]com/b/BPB86 (with custom header x-secret-key: _) and executes it via new Function.constructor("require", src), giving the attacker-controlled response full Node.js require() access. The fetch retries up to 5 times on failure, silently. The package name is a combosquat on the real chai testing library, and the internal code is a trojanized copy of the pino logger. The remote endpoint (jsonkeeper[.]com/b/BPB86) can deliver arbitrary code at runtime — any payload from a system survey to credential theft.