chai-as-reformed @1.2.0

Summary

The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached node lib/caller.js process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an x-secret-key header name/value as base64 literals in a synthetic process.env object decoded with atob ), fetches the JSON response, and passes its cookie field to new Function.constructor("require", s)(require) , executing attacker-controlled JavaScript in the host Node.js process with access to require . The remote payload is mutable and can be changed by the operator of the storage URL at any time.

Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45)