chai-as-format@2.3.5

Analysis

chai-as-format@2.3.5 is a trojanized clone of the pino logger package. On require(), the obfuscated implant in lib/config.js collects system information (hostname, OS, username, platform) and exfiltrates it to a remote C2 server at 167[.]88[.]167[.]54:8085 via multipart POST to /upload (uploading a sysinfo.txt file). It also beacons JSON payloads to /api/log and /api/notify on port 8087. The package uses the axios HTTP library for C2 communication. The package has no repository, no lifecycle hooks, and a nonsensical description.