chai-as-thread@7.0.8

Analysis

chai-as-thread@7.0.8 is a trojanized clone of the pino logger package, published under a combosquat name. When the exported Express middleware is invoked, index.js spawns a detached background Node.js process (lib/initializeCaller.js) that decodes a hardcoded base64 URL (hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json), fetches its contents via axios, and passes the response body to new Function.constructor("require", response) — executing arbitrary remote code from the attacker-controlled server. The payload retries up to 5 times on failure.