chai-as-balanced is a malicious npm package impersonating chai-as-promised and pino. It contains code that defines a fake process.env with a base64-encoded URL pointing to an attacker-controlled JSON storage service. The package fetches a JSON blob containing a 'cookie' field, which is executed via a new Function constructor, granting full Node.js require access. The execution occurs in a detached child process, allowing the malicious payload to run in the background and evade detection. Because the payload is fetched from an anonymous and mutable source, the executed code can change dynamically without new package releases. This enables arbitrary remote code execution for users who mistakenly install chai-as-balanced instead of chai-as-promised and invoke its exported middleware.

Successful exploitation results in arbitrary remote code execution with full Node.js privileges on the host system. The attacker can execute any code, potentially leading to system compromise, data theft, or further malicious activity. The dynamic nature of the payload source means the attacker can change the malicious code at any time without updating the package, increasing the threat's persistence and unpredictability.

No official patch or remediation is currently available. Users should avoid installing chai-as-balanced and verify package names carefully to prevent typosquatting attacks. Since the malicious payload is fetched dynamically, removing the package and replacing it with the legitimate chai-as-promised package is recommended. Monitor dependencies for typosquatting risks and use package integrity verification tools where possible. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.