chai-as-stringify @7.0.2

Summary

chai-as-stringify@7.0.1 is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a ~4MB heavily obfuscated JavaScript payload using obfuscator.io-style transforms (string-array shuffler, hex _0x... identifiers, char-code lookup, control-flow flattening). The .env extension conceals the JS blob from scanners that only inspect .js files. The package's top-level index.js executes require('./lib/config/config') , which resolves to this staged blob and runs it whenever the module is loaded. The package's advertised purpose is unrelated cover: the README is plagiarized verbatim from pino (Transports, Low overhead, nearForm/Platformatic acknowledgments) while claiming to provide 'Chai assertions for testing Reddit API responses'; author metadata is a generic james@abscond.org with homepage https://github.com/james ; CI badges point at the placeholder github.com/yourusername/chai-as-stringify ; the visible exported API is a no-op middleware stub. The combination of a typosquat name, plagiarized/placeholder metadata, and a large obfuscated payload staged under a non-JS extension and auto-loaded on require is the smuggle-and-cover-story supply-chain attack shape.

Source: amazon-inspector (77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d)