The npm package 'chai-as-format' version 2.3.5 contains malicious code disguised as a configuration module. Its main file loads a heavily obfuscated, multi-megabyte decoder that executes on every import, acting as a trojan loader. The package falsely claims to be related to vulnerability management but includes copied content from an unrelated logging framework, indicating impersonation and deception.