The 'chai-promised-test' npm package version 1.3.5 impersonates legitimate packages by copying their README and exports. When used, it launches a detached Node.js process running 'lib/caller.js' which retrieves a string from a remote JSON paste service (jsonkeeper.com) and executes it using the Function constructor with full Node.js capabilities (including require, filesystem, child processes, and network access). The remote code is attacker-controlled and mutable, allowing arbitrary code execution on any system that installs this package. The package hides its command-and-control headers by overriding the local process object with fields such as DEV_API_KEY and DEV_SECRET_KEY, and stores base64-encoded equivalents in 'lib/const.js'. This identity confusion tactic aims to trick users into installing the malicious package accidentally.

Arbitrary code execution on the installer's machine with full Node.js privileges, potentially leading to complete system compromise. The attacker can execute any code remotely by modifying the content fetched from the attacker's controlled URL. This poses a severe risk to any environment where this package is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until then, avoid installing or using the 'chai-promised-test' package version 1.3.5. Verify package authenticity carefully before installation, especially for packages with names similar to popular libraries. Remove the malicious package if already installed and audit systems for signs of compromise.