The 'chai-defender' npm package (versions =1.0.0-beta.1, =1.0.1-beta, =1.0.1, =1.0.2, =1.1.0, =1.1.1) contains malicious code that, upon require, launches a detached Node.js process executing code fetched via HTTP from a hardcoded remote endpoint (http://check-server-state.vercel.app/server/v2). This code is executed using the Function constructor with access to Node's require, enabling arbitrary remote code execution in the context of the installing process. The package falsely presents itself as a Chai assertion plugin, but the fetch-and-execute behavior is unrelated to any legitimate functionality. Additional files mimic legitimate logger project files to appear substantial but are not used. The use of plain HTTP exposes the fetch to in-path payload injection. Any project requiring this package implicitly trusts and executes attacker-controlled code.

Any project that installs or requires the affected versions of 'chai-defender' is vulnerable to remote code execution controlled by the attacker hosting the malicious payload. This allows arbitrary code execution with the privileges of the Node.js process, potentially leading to full system compromise, data theft, or further malware deployment. The use of plain HTTP for fetching the payload increases the risk of man-in-the-middle attacks injecting malicious code.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the 'chai-defender' package in all affected versions (=1.0.0-beta.1, =1.0.1-beta, =1.0.1, =1.0.2, =1.1.0, =1.1.1). Since the package executes remote code on install, uninstalling and replacing it with a trusted alternative is critical. Monitor dependency trees for transitive inclusion of this package and remove it. Check vendor advisories or npm security advisories for updates or official fixes.