MAL-2026-14427 Malicious code in chai-as-mno (npm)

The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project (pino), while the package.json description is unrelated boilerplate. The declared main index.js exports a trivial no-op Express middleware (_req,_res,next)=>next() and unconditionally executes require('./lib/config') at import time. lib/config.js is a ~4MB single-line file heavily obfuscated with an obfuscator.io string-array scheme (string array d of length 23971 with rotation, hex-named identifiers, nested decoder functions j/T, control-flow flattening, and ~40,000 inline-decoded strings). The visible surface API provides no legitimate reason to ship a multi-megabyte opaque blob as a config module, and merely requiring the package runs that payload in the installer's Node process. The combination of impersonation cover story, mismatched README/description, no-op public API, and an obfuscator.io-grade payload executed on require is the loader/dropper shape.