The npm package chai-beta version 1.1.9 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in other npm packages such as chai-await-test. The package is identified as malicious and poses a risk if imported into projects.