MAL-2026-13356

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940) chai-foundry@7.0.2 is a trojan package presenting itself as a chai plugin (README shows `chai.use(chaiLeaf)`) while its badges, documentation, and internal version metadata (`lib/meta.js` exports version `9.6.0`) are copied from the pino logger. The package's main entry `index.js` immediately loads `./lib/config`, a 3.5MB file that is heavily obfuscated with obfuscator.io-class transforms: a rotated string array of 20,855 entries, two runtime decoder functions, tens of thousands of decoder-wrapper indirections, and control-flow flattening (104,934 deobfuscation changes reported by webcrack). The file begins with a top-level IIFE, so its opaque body runs automatically the moment any consumer calls `require('chai-foundry')`. All destinations and string constants are reconstructed at runtime, so the payload's network endpoints and behaviors are hidden from static inspection. The combination of identity impersonation, mismatched metadata, and a multi-megabyte control-flow-flattened import-time loader in a package advertised as a small chai plugin is the canonical shape of a hostile npm dropper/stealer.