The npm package chai-use-chains versions 1.2.6 and 1.2.7 contain malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. There is no official patch or remediation guidance provided. No known exploits in the wild have been reported.