MAL-2026-6350 Malicious code in chai-as-operated (npm)

Package name impersonates the widely-used chai-as-promised (README instructs chai.use(chaiAsOperated)) and the README badges further impersonate pino (npm/GitHub Actions shields point at pinojs/pino). On require('chai-as-operated'), index.js exposes a middleware factory that spawns a detached node./lib/initializeCaller.js. That script defines a fake process object containing base64-obfuscated values (DEV_API_KEY decodes to https://amethyst-lorrin-26.tiiny.site/index.json, plus obfuscated x-secret-key header credentials), then performs axios.get(apiEndpoint,...) and executes the response body via new Function.constructor('require', response)(require) with retry logic. The remote payload runs with full Node require access in a detached background process. The destination is a free tiiny.site host — author-mutable, anonymous infrastructure — and the URL is hidden behind base64 to evade casual review and string scanners. This is a classic typosquat + remote-execution dropper.