chai-as-format@2.3.5

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary command execution and exfiltration-capable behavior under the consuming process identity.

Obfuscated import-time execution with process spawning and network transmission.

A consumer imports index.js, which immediately requires lib/config.js. That file is an unusually large obfuscated payload whose decoded literals show filesystem access, execSync/spawn, axios network requests carrying structured data, crypto, dynamic Function construction, and process manipulation. This behavior is unrelated to the exposed no-op middleware and creates a concrete execution and data-transmission surface at import time.

The runtime entrypoint loads a concealed payload with command-execution and outbound-request primitives that are not package-aligned. Lack of an install hook does not mitigate import-time execution.