chai-as-thread@7.0.8

On require, the package spawns a detached node child that runs lib/initializeCaller.js. That script decodes a base64-obscured URL (https://tomato-brunhilda-40.tiiny.site/index.json) and base64-obscured header credentials, fetches JSON from the endpoint via axios, and executes the returned `cookie` field with full `require` access using `new Function.constructor("require", response)(require)`. The remote host is an anonymous tiiny.site subdomain that can serve arbitrary code at any time. The package name mimics `chai-as-promised` and the README impersonates the `pino` logger project, indicating a typosquat lure delivering a remote-code-execution dropper.