Malicious code in chai-as-testkit (npm)

Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/, index.d.ts, and lib/ tree proto, levels, transport, worker,...