chai-as-sleek@7.1.2

Analysis

chai-as-sleek is a trojanized clone of the pino logger. The package's entry point (index.js) loads lib/config.js, a 4MB obfuscated payload (javascript-obfuscator output with hex-escaped method names and a string-array decoder) that executes when the module is required. The package declares an axios network dependency that the legitimate pino code it clones never uses, and ships no legitimate config module — lib/config.js is the injected malicious component. The obfuscated payload's network targets are not recoverable from the obfuscated source.