The chain-js-utils package (version 2.1.1) masquerades as the pino logging library by shipping pino's documentation and headers and exporting a pino alias. However, its runtime is an Express middleware factory that, upon invocation, spawns a detached child process running 'node lib/vcall.js'. This child process fetches JSON data from an unauthenticated and mutable remote URL (https://api.jsonsilo.com/public/94b14d9d-6286-4b13-a7fe-8442e55a31b4), extracts a 'model' field containing JavaScript source code, and executes it in-process with full Node.js privileges, including the ability to require modules. The middleware calls next() to appear benign, while the detached child process persists beyond the parent process lifecycle. The remote payload can be changed at any time, enabling silent arbitrary code execution in any application that uses this package.

Any application that includes chain-js-utils version 2.1.1 and uses its middleware is at risk of silent remote code execution with full Node.js privileges. The attacker can execute arbitrary JavaScript code fetched from a remote, unauthenticated, and mutable endpoint, potentially leading to full system compromise, data theft, or further malicious activity. The detached child process design makes detection and termination difficult.

No official patch or remediation is currently documented. Users should immediately remove or replace the chain-js-utils package version 2.1.1 from their projects. Avoid using this package or any untrusted middleware that executes remote code. Monitor dependencies for malicious packages and verify package authenticity before use. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.