chai-submision@0.5.4

Analysis

Package name "chai-submision" is a typosquat of the legitimate chai-as-promised testing library (missing an 's' — "submision" vs "submission"). The package ships a clean clone of the real library's source code with no injected payload in this version, but the typosquat name targets developers who mistype the package name when installing a popular Chai promise-assertion plugin. The package has no repository URL, no lifecycle hooks, and no network behaviour — the attack vector is the name impersonation itself, designed to trick developers into installing the wrong package.