The 'chain-await-dom' npm package version 1.3.4 exports a factory function 'check()' that spawns a detached, unreferenced Node.js child process running 'lib/vcall.js'. This child process fetches JavaScript code from a mutable remote JSON storage endpoint and executes it using 'new Function.constructor', allowing arbitrary remote code execution. The package also stores a base64-encoded secondary endpoint used as a fallback for remote code execution. It re-exports the factory as 'module.exports.pino' to mimic the 'pino' logger API, misleading users about its true functionality. The malicious child process persists beyond the parent process, increasing the risk of unnoticed exploitation. The package name and README falsely describe unrelated functionality, further obscuring the threat.

Any application that installs and requires 'chain-await-dom' version 1.3.4 is vulnerable to arbitrary remote code execution with full privileges of the Node.js process. This can lead to complete system compromise, data theft, or further malware deployment. The malicious child process runs detached and unreferenced, making detection and termination difficult. There are no known exploits in the wild reported yet, but the potential impact is critical.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'chain-await-dom' version 1.3.4 from their dependencies and avoid installing or requiring this package. Verify your dependency tree for indirect inclusion of this package and replace it with trusted alternatives. Monitor for any unexpected child processes spawned by Node.js applications and audit systems for signs of compromise. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.