chai-as-disarmed@3.2.3

Analysis

Combosquat package impersonating the chai assertion library. When the exported middleware function is required, it spawns a detached Node.js subprocess that fetches a second-stage payload from api[.]jsonstorage[.]net (hxxps://api[.]jsonstorage[.]net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a) using a custom x-secret-key header, then executes the returned code via the Function constructor — a remote code execution downloader. The package has no repository URL and its description is a generic placeholder unrelated to its stated purpose.