The malicious npm package chai-as-serialized (version 7.0.8) spawns a detached Node.js child process running a script that constructs a fake environment object with base64-encoded fields. These fields decode to a remote URL and a secret request header. The script fetches a JSON payload from the remote URL and executes it using the Function constructor with require access, allowing arbitrary code execution in the consumer's Node.js process. The package mimics legitimate packages to deceive users, and the base64 encoding of the command-and-control URL and secret header confirms hostile intent.

This vulnerability allows remote attackers to execute arbitrary code within the Node.js process of any user who installs the affected package version. This can lead to full compromise of the environment where the package is installed, including data theft, system manipulation, or further malware deployment.

No official patch or remediation is currently available. Users should immediately avoid installing or using chai-as-serialized version 7.0.8. Remove the package from existing environments and replace it with trusted alternatives. Monitor for any unexpected child processes or network connections to suspicious domains. Check vendor advisories or npm security advisories for updates on remediation.