The 'chai-as-bench' npm package (version 7.0.3) falsely presents itself as a chai plugin but contains no chai-related functionality. Instead, it loads a heavily obfuscated ~4 MB payload on require(), featuring a large rotating string array, hex-obfuscated identifiers, and control-flow flattening. Other files in the package are copied verbatim from the unrelated 'pino' logger project to disguise its malicious intent. The package exports only a no-op Express-style middleware function. This pattern is consistent with supply-chain attacks targeting developers who accidentally install similarly named malicious packages.

The malicious payload runs automatically when the package is required, potentially enabling unauthorized code execution or data exfiltration in developer environments. The obfuscation and camouflage increase the difficulty of detection. While no active exploits in the wild are reported, the package poses a significant risk to development supply chains if mistakenly installed.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing 'chai-as-bench' version 7.0.3 and verify package names carefully before installation. Use trusted package sources and consider implementing supply-chain security measures such as package integrity verification and dependency auditing.