The 'chai-as-deployer' npm package, specifically versions 2.3.5 and 2.3.6, is a malicious package that impersonates a chai plugin but contains no legitimate functionality. Its tarball includes unrelated documentation and a no-op Express middleware, but crucially it unconditionally requires a heavily obfuscated ~3.5MB bundle at the module's top level. This obfuscated code contains references to 'require', 'exec', 'spawn', and 'axios', indicating it executes child processes and performs outbound HTTP requests. This behavior triggers immediately upon importing the package, making it an import-time stealer or loader. The author metadata is generic and unrelated to the package's claimed purpose, further indicating malicious intent.

Any project that imports 'chai-as-deployer' versions 2.3.5 or 2.3.6 will execute malicious code automatically, potentially leading to unauthorized code execution, data exfiltration, or system compromise via child process execution and network communication. This occurs without any explicit action beyond importing the package, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented for this package. Users should immediately remove 'chai-as-deployer' versions 2.3.5 and 2.3.6 from their dependencies and avoid installing or importing this package. Consider auditing dependency trees for this package and replacing it with trusted alternatives. Monitor for updates from the npm registry or security advisories for any official remediation or takedown.