If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f)
express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which decodes a base64-obfuscated URL (https://gray-dyane-31.tiiny.site/index.json) stored in lib/const.js, fetches a JSON payload via axios with a base64-encoded `dev-secret-key` header, and passes the response's `cookie` field to `new Function.constructor("require", s)`, then invokes the resulting function with the local `require`. This grants the operator of the anonymous tiiny.site host arbitrary code execution inside the installer's Node.js process at middleware setup time, with full access to `require` and the surrounding application context. The destination URL and secret header are base64-encoded rather than plain configuration, and the package's naming, keywords (fast, logger, stream, json), and pino-mirroring script names disguise a remote code loader as a well-known logging library.