chain-async-dom@1.3.6

Analysis

chain-async-dom@1.3.6 is a trojanized clone of the pino logging library. When the module is loaded (require('chain-async-dom')), it spawns a detached Node.js child process that fetches a remote payload from an IPFS gateway (hxxps://emerald-accurate-urial-9[.]mypinata[.]cloud/ipfs/bafkreify2ijjvromekknzxzvqaopft6muwlpl37mvmpdeazwzzkbjzkuxm) and executes it via Function.constructor, enabling arbitrary remote code execution on the installer's machine.