The npm package chai-as-adapter version 1.5.2 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. No official patch or remediation guidance is currently provided.