chai-secure@1.2.3

Analysis

chai-secure is a combosquat of the popular chai assertion library. On require(), it spawns a detached background process that contacts the C2 endpoint hxxp://server-genimi-check[.]vercel[.]app/defy/v3 with the header 'bearrtoken: logo'. If the server responds with HTTP 404 and a 'token' field in the response body, that field is executed as arbitrary JavaScript code via the Function constructor with access to require(), enabling full remote code execution on the installer's machine. The package also exports a legitimate-looking Chai plugin for security assertions (JWT, XSS, SQLI validation) as camouflage. C2 host: server-genimi-check[.]vercel[.]app, path: /defy/v3.