chai-as-serialized@7.0.8

Analysis

chai-as-serialized is a combosquat package impersonating the chai assertion library. On require(), it spawns a detached background Node.js process that fetches attacker-controlled code from hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json (with a custom x-secret-key header) and executes it via the Function constructor with full access to Node.js require(), enabling arbitrary remote code execution. The remote payload can serve different second-stage malware per request, including credential theft or crypto-draining code. The package has no repository, a generic description unrelated to its name, and no legitimate functionality.