chai-as-doc@2.3.5

Analysis

Package "chai-as-doc" is a combosquat trojan. When required, its exported middleware function spawns a detached background process that: (1) decodes a base64-embedded C2 endpoint at hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df, (2) POSTs the entire process.env object to that endpoint (exfiltrating all environment variables including API keys, tokens, and secrets from the installer's environment), and (3) executes arbitrary code returned by the C2 server via new Function() — enabling remote code execution on the victim's machine. The C2 host is ipcheck-hashed[.]vercel[.]app, path /api/auth/6c1d60d35852ef0c05df.