chai-as-inspired@2.2.4

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

A consumer invokes the exported middleware; importing `lib/transport.js` also loads `lib/caller.js`.

Remote endpoint operators can execute arbitrary code in the consuming application's user context.

Detached remote payload download and dynamic CommonJS execution.

When the exported middleware is called, `index.js` starts a detached, silent Node process for `lib/caller.js`. The child decodes a hidden JSONStorage endpoint, retrieves a field named `cookie`, converts it into a function with access to `require`, and executes it. This is an unpinned remote code execution channel with no user-visible purpose in a package presented as `chai-as-inspired`.

The package contains a concrete, stealthy runtime chain that fetches and executes attacker-controlled remote JavaScript. Absence of an install hook does not mitigate arbitrary code execution during normal package use.