[email protected] is a typosquatting malicious package that disguises itself as chai-as-promised and mimics the pino logger in its exports and README. Its lib/caller.js shadows the process object to hide base64-encoded constants for a command-and-control URL and related headers. When the package middleware is invoked, it decodes the hidden URL, spawns a detached child process that fetches a JSON document from an attacker-controlled mutable JSON storage endpoint, extracts a 'cookie' field containing JavaScript code, and executes it via Function.constructor with live require access. This design enables the attacker to run arbitrary code on any system that installs or requires this package version.

This malicious package enables arbitrary remote code execution on any system that installs or uses [email protected]. The attacker can change the payload at any time via the mutable JSON storage, allowing dynamic and persistent compromise of affected environments.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing or using [email protected]. Remove any existing installations of this package from your environment and replace it with the legitimate chai-as-promised package or other trusted alternatives. Conduct supply chain audits to detect and prevent use of typosquatting or malicious packages.