MAL-2026-13700

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492) The package is published as `chai-as-deployer` but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is a no-op Express middleware (`return (_req,_res,next) => { next(); }`). index.js unconditionally executes `require('./lib/config')` at module top level, loading a ~3.5MB single-line obfuscator.io-style bundle (rotated string array, decoder functions, hex-escaped identifiers) that has no relationship to pino or the advertised functionality. The obfuscated body contains `require`, `exec`, `spawn`, and `axios` tokens, indicating the decoded code drives child-process execution and outbound HTTP requests. Any consumer that imports `chai-as-deployer` triggers this payload with no further action. Author metadata is generic (`Harrison Thorn <harrisonthorn@protonmail.com>`, bugs URL `harrisonthorn.com`) and the package description is unrelated boilerplate. The combination of cover-story impersonation, no legitimate functionality, top-level require of a heavily obfuscated bundle, and shell+network primitives inside that bundle is the canonical shape of an import-time stealer/loader.