MAL-2026-16196 Malicious code in chai-as-crack (npm)

Package's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <[email protected]>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package.