chai-as-mno @1.0.5

Summary

The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project ( pino ), while the package.json description is unrelated boilerplate. The declared main index.js exports a trivial no-op Express middleware (_req,_res,next)=>next() and unconditionally executes require('./lib/config') at import time. lib/config.js is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array d of length 23971 with rotation, hex-named identifiers, nested decoder functions j / T , control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a config module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on require is the loader/dropper shape.

Source: amazon-inspector (2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381)