The 'chai-as-align' package (version 7.1.0) is a malicious npm package designed to look like the legitimate 'chai-as-promised' library. Its exported middleware factory spawns a detached, unreferenced Node.js child process that runs a script which base64-decodes a hidden URL. This URL points to an attacker-controlled JSON file hosted on an anonymous file-hosting service (tiiny.site). The script fetches a 'cookie' field from this URL using a secret header and executes the fetched code via a dynamically constructed Function constructor bound to the real 'require'. This process runs in a retry loop, effectively yielding full remote code execution on any machine that installs and invokes the middleware. The detached child process with ignored stdio is used to conceal the malicious activity from the host application.

This vulnerability allows an attacker to execute arbitrary code remotely on the installer's machine by delivering malicious payloads through an attacker-controlled URL. The malicious code runs with the privileges of the user executing the package, potentially leading to full system compromise, data theft, or further malware deployment. The typosquatting nature increases the risk of accidental installation by developers expecting the legitimate 'chai-as-promised' package.

No official patch or fix is currently available for this malicious package. Users should immediately remove 'chai-as-align' version 7.1.0 from their dependencies and avoid installing packages with suspicious or typosquatting names. Use verified sources and package names when installing npm packages. Monitor dependency manifests for unauthorized or unexpected packages. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing the package and auditing systems for compromise.