MAL-2026-10668 Malicious code in chain-as-log (npm)

chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time (when a consumer calls chai.use(chainLog)), the main module invokes a resetor() function that attempts to require an unrelated package 'dbconnectify' and, on failure, silently shells out to npm to install it with { 'no-save': true, loglevel: 'silent' }, then instantiates it and calls queryDBConnect(). The resetor() call is placed between two legitimate Assertion.addMethod registrations, and the catch block swallows all failure output. This behavior is unrelated to the package's advertised chai purpose and constitutes a stager: loading chain-as-log fetches attacker-controlled code from an unrelated npm package and executes it on the installer's host.