chai-foundry@7.0.3

Analysis

chai-foundry@7.0.3 is a trojanized clone of the pino logger. The package ships a 4.1MB obfuscated payload in lib/config.js that activates when the module is required. At runtime it beacons to C2 server 167[.]88[.]167[.]54:8087 via POST /api/log (sending hostname, OS, username, and a "Starting client" message) and POST /api/notify (sending a unique user key, hostname, OS, and username). It also exfiltrates system information as sysinfo.txt (hostname, OS, username, platform, timestamp) via multipart/form-data POST to 167[.]88[.]167[.]54:8085/upload. The C2 communication uses the axios HTTP library with a validation header on each request. The package has no repository, no README, and its description is generic filler text.