chai-as-deployer@2.3.6

High-risk behavior combination matched malicious policy.

Any application require/import of chai-as-deployer.

Hidden runtime execution can inspect the host and launch additional commands or payload behavior.

Import-time obfuscated payload with decoded process and filesystem operations.

Requiring index.js immediately evaluates lib/config.js. That file is a 4 MB obfuscated, self-decoding payload unrelated to the advertised middleware; its source includes anti-analysis logic, directory enumeration, and construction of process-execution options. Since index.js does not use the imported config and otherwise returns a no-op middleware, the import exists to trigger concealed behavior.

The hidden import-time payload and concealed host/process capability are concrete malicious behavior, not package-aligned functionality. Absence of an install hook does not mitigate execution on normal import.