The npm package chai-deflect contains malicious code that executes arbitrary code on any host importing the module. It does so by launching a detached child process that fetches a payload from a remote server via an HTTP GET request. If the server responds with a 404 status containing a token field, the response body is executed dynamically using new Function, enabling remote code execution. The package masquerades as a Chai assertion plugin but includes unrelated filler code and hides a secondary URL in a base64-encoded constant. This behavior classifies it as a remote-loader dropper with critical impact.