chai-presentation@0.0.2

Analysis

Combosquat package impersonating the chai assertion library. On require(), index.js spawns a detached Node.js child process running lib/caller.js, which fetches a remote payload from a C2 endpoint (constructed from config values) and executes it via new Function.constructor. Additionally, index.js contains an inline runHandler that fetches from hxxps://www[.]jsonkeeper[.]com/b/PC5CK and executes the response as code. The attacker gains arbitrary code execution on the installer's machine.