chai-check-errornpm

Package name and metadata impersonate the legitimate chaijs check-error utility (same author string, same repo URL, same description). index.js adds a resolveConfig() function called at module top-level that fetches a base64-obfuscated URL — https://jsonkeeper.com/b/JOCBY (encoded as anNvbmtlZXBlci5jb20vYi9KT0NCWQ== and decoded with Buffer.from(..., 'base64').toString()) — parses the JSON response, and passes the .cookie field into new Function('require',...)(require), evaluating attacker-controlled JavaScript with require injected. The same index.js is wired both as postinstall (node index.js) and as the package main, so the remote-code-execution path fires automatically on npm install and again on every require('chai-check-error'). jsonkeeper.com is a public, mutable, anonymous paste host — the author can swap the executed payload at any time without republishing. The combination of typosquat impersonation, base64-hidden C2, mutable remote payload, and eval-with-require gives the attacker arbitrary code execution on any installer or consumer machine.