chai-sdk@1.4.7

Analysis

chai-sdk is a combosquat package impersonating the chai assertion library. On import, index.js spawns a detached node process running lib/initializeCaller.js, which fetches a remote payload from amethyst-lorrin-26[.]tiiny[.]site/index.json and executes it via new Function("require", response.data.cookie), giving the attacker arbitrary code execution with full access to the Node.js require() module. The C2 URL is base64-encoded in the source.