[email protected] and 2.3.6 is a typosquatting and repackaged malicious npm package mimicking pino. It includes a top-level immediately-invoked function expression (IIFE) that runs on require, which base64-decodes a hardcoded URL and sends the host's entire process environment variables via an HTTP POST request to that URL with a secret header. The response body is then executed as JavaScript code with require injected, allowing attacker-controlled code execution with full access to the Node.js module system. This results in bulk exfiltration of environment variables (including AWS, GCP, CI tokens, and other secrets) and arbitrary remote code execution on any host that loads the module.

This malicious package allows attackers to exfiltrate all environment variables from the host process, potentially leaking sensitive credentials and secrets such as cloud service tokens and CI environment variables. Additionally, it enables arbitrary remote code execution within the Node.js process, which can lead to full compromise of the affected system or environment.

No official patch or remediation is currently documented. Users should immediately remove and avoid using chai-as-soul versions 2.3.5 and 2.3.6. Verify dependencies to ensure no malicious typosquatting packages are included. Use trusted package sources and consider implementing package integrity verification. Monitor for any unexpected network connections or process behavior related to this package.