The 'chai-as-format' npm package at version 2.3.5 includes an index.js that unconditionally requires a large (~4MB) obfuscated file containing a hex-encoded string array and complex decoding logic. This obfuscated code executes on every require call, effectively acting as a trojan loader. The package's README, LICENSE, and documentation are copied from the unrelated 'pino' logging framework, while the package.json description misleadingly references vulnerability management. This mismatch and the presence of a large opaque decoder module indicate that the package is malicious, designed to load hidden malicious code under the guise of a legitimate package.

Any system that installs or imports 'chai-as-format' version 2.3.5 will execute the embedded obfuscated code, potentially leading to unauthorized code execution or compromise. The obfuscation and deception suggest the package is intended to evade detection and perform malicious actions on the installer's machine.

No official patch or remediation is currently documented. Users should avoid installing or using 'chai-as-format' version 2.3.5. Remove the package from any affected environments and replace it with trusted alternatives. Monitor for any unexpected behavior related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.