chai-logger@3.0.2

Analysis

chai-logger@3.0.2 is a trojanized clone of the pino logger that ships a 4MB heavily-obfuscated module lib/query.js which executes automatically when the package is required (index.js loads it at module load). The module is obfuscated with the javascript-obfuscator string-array decoder pattern: thousands of hex-escaped method names and \x-escaped string constants, with no readable logic, hiding the payload's behavior. On install the package attempts network resolution and runs slowly. The package also declares an axios dependency with no legitimate use. The obfuscated payload's full behavior is concealed by the encoding.