Malicious code in chaikit (npm)

The npm package chaikit was published with malicious code disguised as a middleware utility. The package's main entry point (index.js) unconditionally requires a ~4MB obfuscated file (lib/config) that uses RC4 string-array decoding with approximately 23,902 entries and hex-encoded property names. This obfuscated code self-executes immediately upon import via a top-level IIFE, running in any consumer's process without visibility or consent.\n\nThe package included axios as a runtime dependency, providing the opaque code with a network egress channel for potential data exfiltration or command-and-control communication. The advertised middleware functionality in index.js is merely a trivial next() passthrough, making the obfuscated blob the only substantive behavior.\n\nThe package employed social engineering through its metadata: the README impersonates the pino logger project (including pino badges and links), while the package.json description contains unrelated boilerplate text about vulnerability management. A reference to a nonexistent ./pino module further reinforces the cover story. This metadata pattern is consistent with packages designed to be discovered by developers searching for chai or pino tooling.\n\nThe combination of import-time execution of large opaque code, mismatched cover-story metadata, and bundled HTTP client represents the canonical loader pattern for supply-chain installer-harm payloads. The incident was identified and credited to the OpenSSF malicious-packages project.