chai-as-mno@1.0.5

Analysis

chai-as-mno@1.0.5 is a combosquat of the chai assertion library. Its entry point index.js is a decoy that does nothing, but it loads lib/config.js, a 4MB heavily-obfuscated JavaScript file (javascript-obfuscator shape: _0x identifiers, a large hex-escaped string array, a base64 decoder, and anti-debug traps). When the module is loaded, the obfuscated code performs DNS-based beaconing, issuing TXT record queries to a remote host as a command-and-control/exfiltration channel. The package ships no legitimate functionality matching its generic description.