The npm package 'chai-as-promised-plus' version 6.1.3 is a typosquatting malicious package that mimics the legitimate 'chai-as-promised' assertion helper. It contains a large obfuscated JavaScript payload that replaces the module exports at load time, executing attacker-controlled code within the consumer's Node.js process. This behavior is characteristic of supply-chain attacks where malicious code is delivered to users who install the package.