Malicious code in chai-as-reddit (npm)

The npm package chai-as-reddit versions 7.0.2, 7.0.3, and 7.0.4 are trojaned. The package metadata and README claim it is a Chai plugin for Reddit API assertions, but the shipped files are copied from the unrelated Pino logger project to camouflage the true intent. The actual entry point, index.js, loads a large (~4 MB) heavily obfuscated JavaScript payload (lib/config.js) that executes immediately upon requiring the package. This payload uses obfuscation techniques such as hex-string identifiers, a large rotating string array, control-flow flattening, and encoded wrappers, characteristic of supply-chain execution malware. The payload runs in the installer's Node.js process before any exported API is invoked, potentially compromising the host system.

Any computer with this package installed or running is considered fully compromised. The malicious payload executes automatically on import, potentially allowing an attacker full control over the system. All secrets and keys stored on the compromised computer should be considered exposed and must be rotated from a different, secure machine. Removing the package does not guarantee removal of all malicious software installed as a result of this compromise.

Remove the affected versions (=7.0.2, =7.0.3, =7.0.4) of the chai-as-reddit package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure environment. Due to the nature of the compromise, assume full system compromise and consider rebuilding the affected system to ensure complete remediation.