The npm package [email protected] and 7.0.3 is a trojan package masquerading as a chai plugin. It copies badges, documentation, and version metadata from the unrelated pino logger to mislead users. Its main entry point loads a 3.5MB heavily obfuscated JavaScript file that uses string array rotation, runtime decoding, and control-flow flattening to conceal its true behavior. This obfuscated code runs immediately when the package is required, reconstructing network endpoints and payloads at runtime to evade static analysis. The package exhibits classic characteristics of a hostile npm dropper or stealer designed to compromise systems that install it.

Users who install and require chai-foundry versions 7.0.2 or 7.0.3 risk executing malicious code that can perform unauthorized actions such as dropping additional payloads or stealing data. The obfuscation and runtime decoding make detection and analysis difficult, increasing the risk of unnoticed compromise. No known exploits in the wild are reported, but the package's behavior poses a significant security risk if used.

No official patch or remediation is currently available. Users should immediately remove and avoid installing chai-foundry versions 7.0.2 and 7.0.3. Verify dependencies and use trusted package sources. Monitor for any updates from the package maintainers or npm advisories for remediation guidance.