The 'chai-smart' npm package (version 2.3.5) contains malicious code that, upon use, spawns a detached Node.js child process running a script that base64-decodes a hardcoded URL. This script posts the entire environment variables of the host process to an attacker-controlled endpoint and executes arbitrary code returned by that endpoint using a dynamic Function constructor. The package's API mimics the pino logger but serves as a cover for this background malicious activity, enabling bulk exfiltration of sensitive environment variables (such as cloud credentials, tokens, and database passwords) and arbitrary code execution within the consumer's Node.js environment.

This malicious package enables attackers to exfiltrate all environment variables from the consumer process, potentially leaking sensitive credentials and secrets. Additionally, it allows arbitrary code execution in the consumer's Node.js process, which can lead to full system compromise or further malicious activities. The impact is severe due to the combination of credential theft and remote code execution.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 2.3.5 of 'chai-smart' from their dependencies and avoid using this package. Verify your environment for any signs of compromise if this package was used. Consider replacing it with a trusted and verified logging package. Monitor for any suspicious activity related to environment variable exposure or unauthorized code execution.