chain-await-dom@1.3.4

Analysis

chain-await-dom@1.3.4 and notifier-funcs@1.3.4 are trojanized packages that masquerade as logging utilities. When required, index.js spawns a detached child process that runs lib/vcall.js. This script uses axios to fetch a payload from hxxps://api[.]jsonsilo[.]com/public/c6c0b393-932f-4ae1-8fca-23c6747f4acc and executes it via the Function constructor, giving the remote server arbitrary code execution in the context of the importing application. The C2 endpoint is api[.]jsonsilo[.]com (path /public/c6c0b393-932f-4ae1-8fca-23c6747f4acc). The package also ships a .env file referencing hxxp://vercel-five-coral[.]vercel[.]app/.