Malicious typosquat of chai-as-promised (attacker-owned throwaway account, not a takeover). Package ships a stolen copy of the pino logger as camouflage; the real payload is a ~4MB obfuscated blob in lib/config.js that is executed at import via index.js (require + child_process.spawn behind a decoy middleware). On execution it beacons to a Cloudzy VPS (54.167.88.167). Same campaign as version 6.0.3.