The lockedin-chai-chain npm package at version 1.2.6 is identified as malicious. When imported, it downloads a C2 dropper payload from https://jsonkeeper[.]com/b/FAWPU and executes it, enabling potential remote control or further malicious activity. This package is part of the npm ecosystem and has been flagged by Amazon Inspector and the GCVE database. There is no information on a patch or fix, and no known exploits in the wild have been reported.

The malicious code enables execution of a remote payload, which can lead to unauthorized control of the affected environment where the package is used. This poses a significant security risk including potential data compromise or system manipulation. Since the package executes a C2 dropper, it may facilitate persistent access or further malware deployment.

No official patch or remediation guidance is provided. Users should immediately remove or avoid using the lockedin-chai-chain package version 1.2.6. Verify dependencies and replace this package with a trusted alternative. Monitor for any unusual activity related to this package and consider scanning environments where it was used for signs of compromise.