If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c)
The package's index.js unconditionally requires./lib/config, which is a ~4MB single-line file consisting of an obfuscator.io-style hex-encoded string array (23,953 entries) with rotate/decoder functions and heavy control-flow flattening. This obfuscated code executes at every require('chai-as-format') on the installer's machine. The package presents itself under the name chai-as-format but its README, LICENSE, docs, and lib/* content are copied from the unrelated pino logging framework (LICENSE cites pinojs/pino), while the package.json description references vulnerability management — the cover story does not match the shipped content. A multi-megabyte opaque decoder auto-loaded on import is not a legitimate config module; the shape is a trojan loader hidden behind an impersonation shell.