The npm package lockedin-chai-chain version 1.2.6 contains malicious code that downloads and executes a command-and-control (C2) dropper from a remote URL. This behavior is similar to previously observed malware in related packages. No official patch or remediation guidance is provided in the available data.