The 'chai-presentation' npm package contains malicious functionality triggered on require(). Its index.js performs an HTTPS GET request to a remote JSON paste URL and executes the 'cookie' field content as JavaScript code using Function constructor with the host's require function, granting full Node.js execution rights. Additionally, it spawns a detached Node child process that polls another remote URL and executes code from the response token if a 404 is returned. The package masquerades as a chai plugin but includes unrelated dependencies and misleading README content, indicating an impersonation attack. This results in two independent remote code execution vectors at import time. The affected versions are 0.0.1 through 0.0.4.

Successful import of this package results in immediate arbitrary code execution with full Node.js privileges on the host machine. This can lead to complete system compromise, data theft, or further malicious activity. The malicious code is fetched dynamically from attacker-controlled URLs, allowing flexible and evolving payloads. There is no indication of known exploits in the wild yet, but the risk is critical due to the nature of remote code execution.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'chai-presentation' versions 0.0.1, 0.0.2, 0.0.3, and 0.0.4 from their dependencies and avoid installing it. Verify package authenticity before installation and prefer official, well-maintained chai plugins. Monitor for vendor advisories or updates regarding this package for any future remediation.