The chai-redirection npm package masquerades as a chai assertion plugin but contains embedded malicious code that triggers remote code execution immediately upon being required. Its main entry point spawns a detached Node child process that performs an HTTPS GET request to a mutable pastebin-style URL, retrieving JavaScript code from the response's 'cookie' field and executing it with full Node.js require privileges. A secondary code path fetches a token from a configurable URL and executes it similarly, providing a second remote code execution vector. Because the malicious code runs before any exports are accessed, simply requiring the package triggers execution of attacker-controlled code. The mutable external source allows the attacker to change the payload at any time without republishing the package, making the threat dynamic and persistent. This behavior effectively compromises any system that installs or runs this package.

Any system that installs or runs the affected versions of chai-redirection is subject to immediate and full remote code execution by an attacker-controlled payload. This grants the attacker full control over the Node.js process environment, including access to require modules, enabling arbitrary code execution, data theft, and system compromise. Because the malicious code runs on package load, the risk exists even if the package's exported API is never used. The mutable external payload source means the attacker can update or change the malicious code at will, increasing the risk of ongoing compromise. Systems with this package should be considered fully compromised, and secrets or keys stored on them should be rotated from a trusted environment.

No official patch or fix is currently available. The recommended mitigation is to immediately remove all affected versions (=0.0.1, =0.0.3, =0.0.4) of the chai-redirection package from all systems. Because the package executes attacker-controlled code with full privileges, any system that had this package installed or running should be treated as fully compromised. All secrets, credentials, and keys stored on the system should be rotated from a different, trusted machine. Additional forensic analysis and remediation may be necessary to ensure complete removal of any malicious artifacts. Monitor vendor advisories for any future updates or official fixes.