chai-as-promised-plus @6.1.3

Summary

The package name mimics the widely-used chai-as-promised assertion helper and reuses its README/description. lib/chai-as-promised-plus.js defines the legitimate plugin factory and then overwrites module.exports with require('./config/config'), so any consumer that imports the package loads lib/config/config.js. That file is a 3,546,568-byte single-line javascript-obfuscator.io bundle (rotated string array of length 20721, two decoder functions, control-flow-flattening dispatcher of the form while(!![]){try{...}catch(o){y.push(y.shift())}}, hex-keyed object literals). A test-assertion helper has no legitimate need to ship a multi-megabyte obfuscated blob that replaces its exports at load time; the concealed payload runs in the consumer's Node.js process on require, which is the standard shape of a typosquat supply-chain attack delivering attacker-controlled code to the installer.

Source: amazon-inspector (be02bee1e19ad24ae6091f0793dc22af62e54030388bbdc7d1aa29b078ac17a5)