chai-as-sleek@7.1.2

Summary

Package published as 'chai-as-sleek' impersonates the pino logger: README, LICENSE, docs/, and index.d.ts are copied verbatim from pino, while package.json description reads 'This document describes the management of vulnerabilities...' and the README also markets the package as a chai plugin. The main entrypoint index.js unconditionally executes require('./lib/config') at load time. lib/config.js is a single ~4 MB line of obfuscator.io-obfuscated JavaScript (23,868-entry rotated string array, decoder functions T and j, control-flow flattening, ~20k decoder-wrapper calls) with no configuration content. package.json declares axios ^1.10.0 as a runtime dependency, but no readable source file imports axios — the only reachable consumer of the HTTP client is the opaque blob in lib/config.js. Any consumer that imports 'chai-as-sleek' executes this hidden payload at require() time with outbound HTTP capability provisioned.

Source: amazon-inspector (782914cb65e0d30697eb54f50a4c5b740a3a53941abc185759e296c1d2ec8e9e)