The npm package chai-as-adapter version 1.5.2 is identified as malicious. When imported, it downloads a C2 dropper from https://jsonkeeper[.]com/b/FAWPU and executes it, enabling potential remote control or further malicious activity. This package is part of the npm ecosystem and has been flagged by Amazon Inspector and the GCVE database. There is no CVSS score or detailed vendor advisory available, and no known exploits in the wild have been reported.

Users who install and import chai-as-adapter version 1.5.2 risk executing malicious code that could lead to system compromise or unauthorized remote control. The malicious payload is a dropper that may facilitate further malware deployment or data exfiltration. No direct evidence of exploitation in the wild is currently known.

No official patch or remediation is currently documented. The best mitigation is to avoid using the chai-as-adapter package version 1.5.2. Users should remove this package from their projects and replace it with trusted alternatives. Monitor official advisories for updates or patches.