Firmware Over-the-Air (FOTA)

If you want to avoid the concatenation, you can implement as follows (with a split write of writing command and address first and then the data):

AT25.prototype.write= function(add,data) {
    if(typeof data!="string"){data=E.toString(data);}
    var l=data.length, idx=0, c, i, t;
    while (l>0) {
        c=E.toString(2,add>>16,add>>8,add);
        i=((i=this.pgsz-(add%this.pgsz)) > l) ? l : i;
        t=data.substr(idx,i);
        while ((this.spi.send(5,this.cspin)[0] & 1) === 1) { ""; }
        this.cspin.reset(); this.spi.send(c);
        this.spi.send(t,this.cspin);
        l-=i;idx+=i;add+=i;
    }
    return idx;
};

Since you know you have 3 address bytes, you can also drop the cap(acity) check.