MAL-2026-13702 Malicious code in chai-as-map (npm)

The package presents itself as a chai-related utility (name chai-as-map, keywords logger/stream/json, description referencing vulnerability management) and bundles verbatim pino logger source under lib/ (proto.js, levels.js, redaction.js, docs/pino.md, LICENSE crediting pinojs), while the exported API in index.js is only a no-op Express middleware. index.js requires./lib/config on module load, and lib/config.js is a 4,083,409-byte obfuscator.io-style hex string array (~23,953 entries) with rotated decoders and control-flow flattening, containing no readable code. Loading the package therefore executes an opaque 4MB blob at import time. package.json also declares axios ^1.10.0 as a runtime dependency despite the advertised middleware performing no network I/O, aligning the module graph with a loader that reconstructs a remote destination from the obfuscated strings at runtime. The combination of typosquat naming, cover-story pino contents, an unrelated no-op public API, and a large obfuscated payload auto-executed on require is the shape of a stealer/loader delivered through name confusion.