chai-as-precision@7.0.6

Analysis

chai-as-precision@7.0.6 is a combosquat of the popular chai assertion library. On import, index.js spawns a detached background Node.js process that runs lib/initializeCaller.js. That script decodes a base64-embedded URL (hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json), fetches it via HTTP GET with a custom header, and passes the response body to new Function.constructor("require", ...) — executing arbitrary remote code as a second-stage payload. The fetch retries up to 5 times on failure. The C2 host is tomato-brunhilda-40[.]tiiny[.]site.