Malicious code in chai-jsonss (npm)

The npm package chai-jsonss was published with malicious code embedded in its index.js entry point. On import, the package invokes a postCallers() function that decodes a base64-encoded URL from lib/const.js, resolving to https://1uznbx.s.gy/7xdQmt.\n\nThe package then fetches the response via axios, base64-decodes the response.data.model field, and passes the result to new Function(require), executing arbitrary attacker-controlled JavaScript in the importing process. The malicious URL is obfuscated as a DEV_API_KEY field on a fake process.env-shaped local module, and the payload URL points to a mutable remote resource controlled by the attacker.\n\nThe package name resembles the legitimate chai testing library but contains no chai-related functionality. Its sole import-time behavior is to fetch and execute remote code, making it a pure malware delivery mechanism.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.