Malicious code in chai-as-structured (npm)

The 'chai-as-structured' package (version 7.0.5) is a typosquatting malicious npm package that impersonates a legitimate package but contains harmful code. When its middleware factory is invoked, it spawns a detached Node.js child process running 'lib/initializeCaller.js'. This script creates a fake environment variable stub with base64-encoded fields that decode to a URL and request headers targeting an anonymous file-hosting service. The response includes a cookie string that is executed dynamically with full Node.js privileges via 'new Function.constructor', enabling arbitrary code execution. The use of base64 concealment, misleading environment variable names, detached child processes, and typosquatting techniques indicate a deliberate supply-chain attack.

This malicious package allows remote code execution with full Node.js privileges by fetching and executing arbitrary code from a remote anonymous host. This can lead to compromise of the host environment where the package is installed, potentially exposing sensitive data, enabling further attacks, or causing system disruption.

No official patch or remediation is currently documented. Users should immediately remove the 'chai-as-structured' package version 7.0.5 from their projects and replace it with a verified legitimate package. Avoid installing packages with suspicious or typosquatting names. Monitor for any unexpected child processes or network connections originating from Node.js processes. Check vendor advisories or trusted security sources for updates on remediation or detection.