MAL-2026-16380 Malicious code in chai-logger (npm)

The package presents itself as a Chai logging plugin but its main entry index.js requires ./lib/query.js, a ~4 MB obfuscator.io-encoded module (23,868-entry rotated string array, T/j decoder wrappers, hex-property indirection) that executes at the top level as soon as the package is required. The remaining files under lib/ (proto.js, levels.js, tools.js, etc.) are verbatim copies of pino source, unrelated to the advertised Chai plugin API — a cover story around the obfuscated blob. package.json declares axios ^1.10.0 as a runtime dependency, and the only reference to axios in the shipped code is inside the obfuscated body of lib/query.js, giving the payload an HTTP client whose destination is reconstructed at runtime from the rotated string array. Author metadata points to jsonspack.com, unrelated to Chai or pino. The combination of import-time execution of a heavily obfuscated payload, a mismatched cover story, copied third-party source used as filler, and an HTTP client declared only for use inside the obfuscated code is the canonical npm credential/data-stealer shape.