The 'chai-as-polished' npm package is a typosquatting malicious package impersonating 'chai-as-promised'. Its exported middleware spawns a detached, unreferenced child process running a script that constructs a fake environment variable object containing base64-encoded data. This data decodes to a URL hosted on an anonymous static hosting service and a secret header. The package uses axios to fetch a JSON resource from this URL, then executes the 'cookie' field from the response as JavaScript code with Node's require function available, enabling arbitrary attacker-controlled code execution. The base64 encoding is used to obfuscate the URL and header from cursory inspection. Execution requires the consumer to invoke the package's middleware, which is the documented entry point, thus deceiving users who install it by mistake.

Any system that installs and runs the 'chai-as-polished' package and invokes its middleware is fully compromised. The attacker gains the ability to execute arbitrary code with the privileges of the Node.js process. This can lead to complete system takeover, data theft, credential compromise, and persistence of malicious software. All secrets and keys on the compromised system should be considered exposed and rotated immediately from a clean environment.

Remove the 'chai-as-polished' package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or accessible on the compromised machines from a different, trusted system. Do not rely solely on package removal, as the attacker may have installed additional backdoors or malware. Exercise caution to avoid installing similarly named typosquatting packages by verifying package names carefully before installation.