chai-as-assured is a malicious npm package designed to impersonate chai-as-promised by matching its README, author, and API surface. When used, it asynchronously fetches a payload from a hardcoded, obfuscated URL and executes the 'cookie' field of the JSON response as JavaScript code using new Function with require passed in, granting full Node.js module privileges. The attacker infrastructure details (C2 URL and headers) are concealed via base64 strings in a fake local process.env object to evade detection. This results in an unambiguous remote code execution dropper targeting any project that installs and loads this plugin.

Any project that installs and loads chai-as-assured version 7.1.2 is subject to remote code execution by the attacker-controlled payload. The executed code runs with full Node.js privileges, including filesystem, network, and child process access, which can lead to complete system compromise, data theft, or further malware deployment.

No official patch or fix is currently available for chai-as-assured version 7.1.2. Users should immediately remove this package from their dependencies and replace it with the legitimate chai-as-promised package. Avoid installing packages that impersonate popular libraries and verify package authenticity before use. Monitor dependency sources carefully to prevent supply chain attacks.