The chain-async-dom package (version 1.3.6) impersonates a legitimate pino logger by mirroring its internal file structure but contains malicious code. Its main entry point exports a middleware function that spawns a detached Node.js subprocess executing code retrieved from a hardcoded IPFS gateway URL. This fetched code is executed with full access to the Node runtime, filesystem, network, and environment, allowing arbitrary remote code execution. The package also includes additional mutable payload sources, such as a base64-encoded URL to a JSON paste service and an environment variable pointing to another mutable domain, facilitating further attacker-controlled payload delivery. This behavior makes the package a supply chain threat to any consumer who installs and invokes it as intended.

Consumers of chain-async-dom version 1.3.6 who install and invoke the package risk arbitrary remote code execution due to the dynamic execution of attacker-controlled code fetched from mutable external sources. This can lead to full compromise of the Node.js runtime environment, including filesystem and network access, potentially resulting in data theft, system manipulation, or further malware deployment.

No official patch or remediation is currently available for this malicious package. The recommended mitigation is to avoid installing or using chain-async-dom version 1.3.6. Users should remove this package from their dependencies and replace it with a trusted alternative. Monitor package sources carefully to avoid supply chain attacks involving similarly named or impersonating packages.