If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf)
Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process (lib/caller.js) that fetches a JSON payload from a base64-obfuscated jsonstorage.net URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f) and evaluates the returned.cookie string via new Function.constructor("require", s)(require), giving the fetched code full require access on the installer's host. The remote URL and request headers are stored as base64 strings under fake process.env names (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE) and decoded with atob() at runtime to conceal the destination. The package name and keywords (fast, logger, stream, json) impersonate pino while the package name typosquats chai-as-promised.