chai-as-deployer @2.3.6

Summary

The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is a no-op Express middleware ( return (_req,_res,next) => { next(); } ). index.js unconditionally executes require('./lib/config') at module top level, loading a ~3.5MB single-line obfuscator.io-style bundle (rotated string array, decoder functions, hex-escaped identifiers) that has no relationship to pino or the advertised functionality. The obfuscated body contains require , exec , spawn , and axios tokens, indicating the decoded code drives child-process execution and outbound HTTP requests. Any consumer that imports chai-as-deployer triggers this payload with no further action. Author metadata is generic ( Harrison Thorn <harrisonthorn@protonmail.com> , bugs URL harrisonthorn.com ) and the package description is unrelated boilerplate. The combination of cover-story impersonation, no legitimate functionality, top-level require of a heavily obfuscated bundle, and shell+network primitives inside that bundle is the canonical shape of an import-time stealer/loader.

Source: amazon-inspector (c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492)