The 'chai-as-staged' npm package, version 6.0.4, is a malicious package impersonating 'chai-as-promised'. Its README is copied from an unrelated library ('pino') to mislead users. The package's usage triggers a detached Node.js child process running 'lib/initializeCaller.js', which contains base64-encoded strings representing a command-and-control (C2) URL and custom HTTP headers. At runtime, it decodes these strings, fetches a JSON payload from 'https://amethyst-lorrin-26.tiiny.site/index.json', extracts a '.cookie' field containing JavaScript code, and executes this code dynamically using 'new Function.constructor' with full access to Node.js require. This results in attacker-controlled code execution on the victim's machine whenever the package is used as intended.

This malicious package enables remote code execution on any machine that installs and uses it as documented. The attacker gains the ability to run arbitrary JavaScript code with full access to Node.js modules via require, potentially leading to complete system compromise, data theft, or further malware deployment.

No official patch or remediation is provided. Users should immediately remove 'chai-as-staged' version 6.0.4 from their projects and avoid installing packages that impersonate legitimate libraries. Verify package authenticity by checking the official npm registry and package maintainers before installation. Consider using package integrity verification tools and supply chain security measures to prevent installation of malicious packages.