If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953)
The package presents itself as a chai-related utility (name `chai-as-map`, keywords `logger`/`stream`/`json`, description referencing vulnerability management) and bundles verbatim pino logger source under lib/ (proto.js, levels.js, redaction.js, docs/pino.md, LICENSE crediting pinojs), while the exported API in index.js is only a no-op Express middleware. index.js requires./lib/config on module load, and lib/config.js is a 4,083,409-byte obfuscator.io-style hex string array (~23,953 entries) with rotated decoders and control-flow flattening, containing no readable code. Loading the package therefore executes an opaque 4MB blob at import time. package.json also declares axios ^1.10.0 as a runtime dependency despite the advertised middleware performing no network I/O, aligning the module graph with a loader that reconstructs a remote destination from the obfuscated strings at runtime. The combination of typosquat naming, cover-story pino contents, an unrelated no-op public API, and a large obfuscated payload auto-executed on require is the shape of a stealer/loader delivered through name confusion.