If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7)
chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time (when a consumer calls chai.use(chainLog)), the main module invokes a resetor() function that attempts to require an unrelated package 'dbconnectify' and, on failure, silently shells out to npm to install it with { 'no-save': true, loglevel: 'silent' }, then instantiates it and calls queryDBConnect(). The resetor() call is placed between two legitimate Assertion.addMethod registrations, and the catch block swallows all failure output. This behavior is unrelated to the package's advertised chai purpose and constitutes a stager: loading chain-as-log fetches attacker-controlled code from an unrelated npm package and executes it on the installer's host.