The npm package chai-as-chain-v2 version 1.1.1 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. No official patch or remediation guidance is provided.