The npm package 'chai-as-relay' version 1.2.1 contains a heavily obfuscated, multi-megabyte self-executing code blob that executes upon requiring the package. This package impersonates the legitimate 'pino' logger project by copying its non-malicious files but includes a malicious payload that allows arbitrary code execution. The package author and name have no relation to the genuine pino maintainers, indicating a supply chain attack via a malicious package.