chai-presentation @0.0.4

Summary

On require(), index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's cookie field to new Function('require',...) , immediately invoking it with the host's require . This gives whoever controls that jsonkeeper.com paste full Node.js execution privileges on the installer's machine the moment any consumer imports the package. A second staged loader is wired in parallel: index.js top-level spawns a detached, stdio-ignored Node child running lib/caller.js, which polls a URL built from config values and, on a 404 response, passes error.response.data.token to Function.constructor and executes it with require . lib/const.js additionally stores a base64 string under DEV_API_KEY that decodes to https://jsonkeeper.com/b/4NAKK — a second anonymous paste-host URL hidden from plain-string scanning. The package name presents as a chai plugin but the README describes an unrelated package ( chai-submission ), and declared dependencies (axios, request, sqlite3) are unrelated to chai assertions — an impersonation lure wrapping two import-time remote-eval channels.

Source: amazon-inspector (1d078bac337fe2c1b76c757c29d286fc750be585db65f30f5d696038c2ea0d3a)