chai-smart@2.3.5

Analysis

chai-smart is a combosquat of the popular "chai" testing library. When required, index.js spawns a detached background process that runs lib/initializeCaller.js. That script decodes a base64-embedded C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs all environment variables (process.env) to that endpoint — exfiltrating any API keys, tokens, and secrets present in the runtime environment — then executes the server's response as arbitrary code via new Function("require", response.data), giving the attacker full remote code execution on the victim's machine.