The npm package chai-as-evm version 1.1.2 contains malicious code that, when imported, downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in other npm packages such as chai-await-test. There is no CVSS score available for this threat.