chai-as-structured@7.0.5

Analysis

Combosquat package impersonating the chai assertion library (chai-as-structured). On require(), index.js spawns a detached node child process running lib/initializeCaller.js. That script decodes a base64-embedded URL (tomato-brunhilda-40[.]tiiny[.]site/index.json), sends an HTTP GET with a custom header, and passes the response body through the Function constructor with require access — executing arbitrary remote code downloaded from the C2 server.