The chai-as-sets package version 3.1.3 is a malicious npm package that, when required, spawns a detached child process executing lib/initializeCaller.js. This process base64-decodes a hardcoded URL pointing to a command-and-control server and POSTs the entire process environment variables to it. The server's HTTP response body is then passed to a new Function constructor with require injected, allowing the remote server to execute arbitrary code on the host. The package masquerades as a pino-related module to evade detection. This behavior constitutes a supply chain attack via a malicious package.

Any system that installs and requires chai-as-sets version 3.1.3 is at risk of arbitrary remote code execution controlled by the attacker. The attacker can exfiltrate environment variables and execute arbitrary code with the privileges of the process loading the package. This can lead to full system compromise depending on the environment and privileges.

No official patch or remediation is currently documented. Users should immediately remove and avoid using chai-as-sets version 3.1.3. Audit dependencies for this package and replace it with a trusted alternative. Monitor for any unexpected network connections to the indicated C2 URL. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.