chai-as-stringify@7.0.2

High-risk behavior combination matched malicious policy.

Runtime import/require of chai-as-stringify.

Unconsented host metadata and application-supplied data disclosure; background process execution.

Import-time persistence-like process spawning and network exfiltration.

index.js loads lib/config.js immediately. That file runs top-level obfuscated code, imports OS/filesystem/process/network modules, launches detached hidden child processes, and uses axios to transmit a record containing host, OS, username, message, and data to an obfuscated endpoint. This behavior is unrelated to the advertised Chai stringify package.

Source inspection confirms concrete import-time data exfiltration and stealthy background execution. The absence of an install hook does not remove the runtime compromise path.