The 'chai-as-staged' npm package (version 6.0.4) impersonates the popular 'chai-as-promised' testing library and includes a README copied from another unrelated project to appear legitimate. Its usage triggers a detached Node.js child process that runs an obfuscated script ('lib/initializeCaller.js'). This script hides a command-and-control (C2) endpoint and a custom HTTP header encoded in base64 under decoy environment variable names. At runtime, it decodes the URL to a remote JSON resource hosted on an anonymous static site, fetches it with the obfuscated header, extracts a '.cookie' field containing JavaScript code, and executes this code dynamically using the Function constructor with full require access. This results in arbitrary attacker-controlled code execution on the machine installing or using the package.

This vulnerability allows remote attacker-controlled code execution on the user's machine with full access to Node.js require functionality. This can lead to arbitrary code execution, data theft, system compromise, or further malware deployment. The malicious package's impersonation of a legitimate library increases the risk of unsuspecting users installing it.

No official patch or fix is currently available for this malicious package. Users should avoid installing or using 'chai-as-staged' version 6.0.4. Verify package authenticity before installation, prefer official and well-maintained packages, and remove any instances of this package from your environment. Monitor package sources carefully to prevent supply chain compromise.