chai-foundry @7.0.3

Summary

chai-foundry@7.0.2 is a trojan package presenting itself as a chai plugin (README shows chai.use(chaiLeaf) ) while its badges, documentation, and internal version metadata ( lib/meta.js exports version 9.6.0 ) are copied from the pino logger. The package's main entry index.js immediately loads ./lib/config , a 3.5MB file that is heavily obfuscated with obfuscator.io-class transforms: a rotated string array of 20,855 entries, two runtime decoder functions, tens of thousands of decoder-wrapper indirections, and control-flow flattening (104,934 deobfuscation changes reported by webcrack). The file begins with a top-level IIFE, so its opaque body runs automatically the moment any consumer calls require('chai-foundry') . All destinations and string constants are reconstructed at runtime, so the payload's network endpoints and behaviors are hidden from static inspection. The combination of identity impersonation, mismatched metadata, and a multi-megabyte control-flow-flattened import-time loader in a package advertised as a small chai plugin is the canonical shape of a hostile npm dropper/stealer.

Source: amazon-inspector (94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940)