chai-as-verified@7.1.5

Analysis

Combosquat of the chai assertion library. When the package is required, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-embedded URL (hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json), fetches it via axios with a custom header (x-secret-key: _), and passes the response body to new Function.constructor("require", ...) — executing arbitrary remote code with full Node.js require access. The downloader retries up to 5 times on failure. C2 host: tomato-brunhilda-40[.]tiiny[.]site.