The async-chain-dom package (version 1.3.5) includes malicious functionality where requiring the package triggers spawning a detached, unreferenced child process running 'node lib/vcall.js'. This child process repeatedly fetches JavaScript code from a remote URL (https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5) controlled by an attacker. The fetched code is extracted from the '.model' field of the JSON response and executed dynamically using the Function constructor with 'require' passed in, enabling arbitrary code execution within the Node.js process. The detached and unref pattern allows this process to persist beyond the lifecycle of the parent process. The package attempts to disguise itself as the pino logger by mimicking its module exports and file structure, facilitating its inclusion by developers under false pretenses. The remote payload can be changed at any time, allowing the attacker to update the malicious code executed on victims' systems.

This malicious package enables an attacker to achieve arbitrary code execution on any system that installs and requires async-chain-dom version 1.3.5. The persistent detached child process ensures the malicious code continues running independently of the parent process lifecycle. Because the remote payload is mutable, the attacker can modify the executed code at will, potentially escalating impact or changing attack behavior over time. This compromises the confidentiality, integrity, and availability of affected systems and may lead to further compromise or data theft.

No official patch or remediation is currently documented. Users should immediately remove async-chain-dom version 1.3.5 from their projects and dependency trees. Avoid installing or requiring this package. Verify your environment for any running detached Node.js processes spawned by this package and terminate them. Monitor for any unexpected network connections to api.jsonsilo.com or similar domains. Since no fix is confirmed, check vendor advisories or trusted sources for updates. Consider replacing this package with a verified, trusted alternative.