취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f7e00f81e117716cfd7fd3565cf8b04073cd494a6da2c23749669133806a7473)

Package name chai-as-tuned impersonates chai-as-promised and ships a README copy-pasted from the unrelated pino project (npm/CI badges point at pinojs/pino). The advertised middleware in index.js spawns lib/initializeCaller.js as a detached node process whenever the exported function is invoked. That script constructs a fake local process object whose DEV_API_KEY is a base64 literal decoding to https://aqua-margit-84.tiiny.site/index.json (tiiny.site is an anonymous static-hosting service), GETs the JSON via axios, and passes the response.cookie field to new Function.constructor('require', response)(require) — executing attacker-controlled JavaScript with full Node privileges and access to the host's require. The combination of name-confusion, copied README, base64-hidden C2 URL, Function.constructor indirection to defeat static review, and remote-fetch-and-eval is an unambiguous supply-chain attack: any consumer who follows the README and uses the main export will execute whatever code the attacker serves at runtime.