The 'chai-as-sharpened' npm package (version 7.0.9) is a malicious package that, when required, spawns a detached background Node.js process executing 'lib/initializeCaller.js'. This script base64-decodes a hardcoded URL to fetch JSON data containing a 'cookie' field, which is executed via 'new Function.constructor' with full 'require' access, allowing arbitrary code execution on the host system. The package obfuscates its command and control (C2) endpoint and request headers using base64-encoded strings decoded at runtime. It impersonates legitimate libraries such as 'chai-as-promised' and 'pino' to trick users into installing it. This behavior results in unconditional remote code execution against any consumer of the package.

Any system that installs or requires 'chai-as-sharpened' version 7.0.9 is subject to unconditional remote code execution, allowing an attacker to run arbitrary code with the privileges of the user running the Node.js process. This can lead to full system compromise, data theft, or further malware deployment. The malicious package uses obfuscation and name confusion to increase the likelihood of successful exploitation.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or using 'chai-as-sharpened' version 7.0.9. Verify package authenticity before installation and prefer official, well-known packages. Remove any instances of this package from projects and dependency trees. Monitor for suspicious detached Node.js processes spawned during package installation or runtime.