chai-as-crack@7.0.5

Analysis

chai-as-crack is a combosquat of the chai-as-promised assertion plugin. Its main entry (index.js) loads a 4MB heavily-obfuscated script (lib/config.js) at require time and imports child_process.spawn. The obfuscated script uses a javascript-obfuscator-style encoded string-array with a runtime decoder, hiding all of its string constants and network/command targets from static inspection. The package description is unrelated filler text. Because the payload is fully obfuscated, its concrete C2/exfil targets are not recoverable from the source; the package executes its hidden logic whenever the module is required.