chai-as-auth@2.3.5

Analysis

chai-as-auth@2.3.5 is a trojanized clone of the pino logger published under a combosquat name (piggybacking on the chai assertion library). The package ships a malicious IIFE in lib/initializeCaller.js that decodes a base64-embedded C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs the entire process.env (including any NPM_TOKEN, GITHUB_TOKEN, and other credentials) to that endpoint, then executes the response body as arbitrary JavaScript via new Function("require", response.data), enabling full remote code execution. The payload retries up to 5 times on failure. The package has no repository, no lifecycle hooks, and its description and keywords are unrelated to its name.