The 'chai-as-map' npm package (version 2.3.5) is a malicious package designed to appear as a legitimate chai utility. It includes verbatim pino logger source files but exports a no-op Express middleware API. The critical malicious component is a large (~4MB) obfuscated hex string array in lib/config.js, employing rotated decoders and control-flow flattening, which executes automatically upon module import. The package.json declares axios as a runtime dependency despite no network I/O in the public API, indicating the obfuscated code likely reconstructs and contacts a remote endpoint at runtime. This combination of typosquatting, misleading contents, and an opaque auto-executed payload is consistent with a stealer or loader malware delivered through npm.

Loading the package executes a large obfuscated payload that likely performs unauthorized actions such as data theft or loading additional malicious code. The presence of axios as a dependency suggests network communication to a remote server, potentially enabling data exfiltration or further compromise. Users installing or importing this package risk executing malicious code under the guise of a legitimate utility.

No official patch or remediation is available. Users should avoid installing or using the 'chai-as-map' package version 2.3.5. Remove any installations of this package from projects and replace with trusted alternatives. Monitor dependency sources carefully to avoid typosquatting attacks. Since this is a malicious package, remediation involves removal and avoiding its use rather than patching.