The npm package chai-as-byte (versions 3.1.5 and 3.1.6) is a malicious package that, when required, detaches a child process running a script that sends the entire process.env to a base64-obfuscated URL. The response from this URL is executed as JavaScript code with full module require access, allowing the remote endpoint to execute arbitrary code on the host system. This results in exfiltration of environment variables, potentially including sensitive CI secrets, cloud tokens, and API keys. The package falsely advertises itself as a JSON logger and mimics the chai-as-* naming convention to evade detection. No legitimate library functionality is provided; the main entry point solely performs this exfiltration and remote code execution.

This malicious package enables remote attackers to execute arbitrary code on the host system with full module access by exploiting the require process. It also leaks sensitive environment variables, including CI secrets, cloud tokens, and API keys, which can lead to further compromise of build environments and cloud resources.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing the affected versions (=3.1.5, =3.1.6) of chai-as-byte. Audit dependencies to detect and eliminate this package from build environments. Monitor for any unauthorized access or suspicious activity related to leaked credentials. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates on remediation.