chai-secure (npm) versions 1.2.3 and 1.2.5 include malicious functionality where requiring or importing the package triggers a detached Node.js child process that makes an HTTP GET request to a remote server. If the server responds with a 404 status containing a 'token' field, the package dynamically constructs and executes JavaScript code from this token with full privileges on the host. The package uses this covert channel to execute arbitrary attacker-supplied code, bypassing casual inspection by hiding the payload delivery in a 404 response and using plain HTTP. Additional files in the package are included to inflate its apparent legitimacy. This results in silent remote code execution on any system that installs and imports the package as documented.

Any developer or system that installs and imports chai-secure versions 1.2.3 or 1.2.5 will unknowingly execute arbitrary attacker-controlled JavaScript code with full privileges on their machine. This can lead to complete compromise of the host environment, data theft, persistence, or further malicious activity. The malicious code runs silently in a detached background process, making detection difficult without specialized inspection.

No official patch or remediation is currently available for chai-secure. Users should immediately avoid installing or importing this package. Remove any existing installations of chai-secure versions 1.2.3 and 1.2.5 from projects and systems. Monitor for any unexpected child processes or network connections to suspicious domains. Check the vendor advisory or trusted security sources for updates regarding remediation or safe alternatives. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.