The malicious npm package chai-as-smart (version 2.3.5) includes code that, when required, launches a background script which decodes a base64-encoded URL and sends the entire process environment variables to this remote endpoint using axios. The response from the endpoint is dynamically executed as JavaScript code with access to the Node.js require function, granting the attacker arbitrary code execution capabilities within the Node.js process. The package masquerades as a pino-style logger middleware to deceive users. This results in exfiltration of sensitive environment data and enables full remote code execution on any system that installs or imports this package.

Any system that installs or imports chai-as-smart version 2.3.5 is compromised by exfiltration of environment variables, which may include sensitive tokens, cloud credentials, and CI secrets. Additionally, the attacker gains the ability to execute arbitrary code within the Node.js process, potentially leading to full system compromise.

No official patch or remediation is currently available for this malicious package. Users should immediately remove chai-as-smart version 2.3.5 from their projects and dependency trees. Avoid installing or requiring this package. Review and rotate any potentially exposed credentials or secrets that may have been compromised. Monitor for any unauthorized activity resulting from this compromise.