chai-as-hardened@7.0.9

Analysis

Combosquat package impersonating the chai assertion library, trojanized with a clone of the pino logger. When required, index.js spawns a detached child process running lib/initializeCaller.js, which fetches a remote payload from hxxps://tomato-brunhilda-40[.]tiiny[.]site/index[.]json via axios and executes it using the Function constructor with access to require(), enabling arbitrary remote code execution on the installer's machine. The C2 host is tomato-brunhilda-40[.]tiiny[.]site.