Malicious code in chai-as-bench (npm)

chai-as-bench is a malicious npm package designed to exploit typos of the legitimate chai-as-promised library. The package falsely presents itself as a chai assertion plugin through its name and manifest description, but contains no actual chai-related functionality.\n\nUpon require(), the package unconditionally loads lib/config.js, which is a ~4 MB obfuscated payload generated by obfuscator.io. The obfuscation includes a 23,890-entry rotating string array, hex-obfuscated identifiers, and control-flow flattening—all hallmarks of a loader/stealer mechanism. The remaining library files (proto.js, multistream.js, transport.js) and LICENSE are copied verbatim from the unrelated pino logger project to serve as camouflage. The index.js file itself only exports a no-op Express-style middleware, providing no legitimate functionality.\n\nThe package metadata includes placeholder GitHub URLs (yourusername) and generic author information (james@abscond.org), further indicating malicious intent. This is a classic supply-chain attack targeting developers who mistype the popular chai-as-promised package name.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.