The 'chain-chai-await' npm package impersonates the pino logging library by mirroring its file layout and exports but is unrelated to the genuine package. When used, it spawns a detached Node subprocess that performs an HTTP GET request to a public JSON paste URL to retrieve a 'cookie' field containing JavaScript code. This code is executed dynamically using the Function constructor with access to Node's require function, allowing arbitrary remote code execution in the context of the consumer's process. The package includes obfuscated backup URLs and header keys to maintain persistence and evade detection. This behavior identifies it as a malicious dropper disguised as a logging library. The affected versions are exactly 1.3.5, 1.3.6, and 1.3.7. No official patch or remediation guidance is currently available.

Exploitation of this malicious package leads to arbitrary remote code execution within the Node.js process of any consumer that installs and uses it. This grants an attacker full access to the require function, enabling loading of any module and execution of arbitrary code with the privileges of the Node process. This can result in complete system compromise, data theft, or further malware deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, users should immediately remove the 'chain-chai-await' package versions 1.3.5, 1.3.6, and 1.3.7 from their projects and replace it with a verified legitimate logging library. Avoid installing packages from untrusted sources and verify package authenticity before use.