chai-as-map@2.3.5

Analysis

chai-as-map is a combosquat of the legitimate chai-as-promised package. It ships a verbatim copy of the pino logger library (v9.6.0) as camouflage, with a 4MB javascript-obfuscator-encoded payload file at lib/config.js. The payload executes when the module is loaded via require(). The package has no repository, no documented purpose matching its name, and the obfuscated payload's behaviour could not be observed at runtime because the version was unpublished before the sandbox could install it.