chai-as-byte@3.1.5

Analysis

chai-as-byte@3.1.5 is a combosquat package (trojanized clone of the pino logger) that exfiltrates all environment variables and fetches a second-stage payload. On require(), package/index.js spawns a detached child process running lib/initializeCaller.js. That script base64-decodes the C2 URL (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs the full process.env object (including NPM_TOKEN, GITHUB_TOKEN, AWS credentials, and other CI/CD secrets) as JSON with a custom header (x-secret-header: secret), then executes the server's response as arbitrary code via new Function("require", response.data).