The 'chai-as-type' npm package contains malicious code that, upon import, downloads a command-and-control (C2) dropper from a remote URL and executes it within the Node.js process. It impersonates legitimate chai assertion libraries but actually functions as a pino-shaped middleware that spawns a child process to run a loader script. This loader fetches attacker-controlled JavaScript from a public JSON paste host, decodes base64-encoded URLs, and executes the payload with full module access. The attacker can modify the remote payload at any time, enabling dynamic delivery of malicious code such as credential theft or persistence mechanisms without republishing the package. The malicious behavior is triggered either by invoking the middleware or running the 'smoke:pino' npm script.

This malicious package allows arbitrary code execution in the Node.js environment of any project that installs or imports it. Because the payload is fetched dynamically from a mutable remote source, attackers can update the malicious code at will, potentially leading to credential theft, system compromise, or persistence. The impersonation of popular libraries increases the risk of accidental installation by developers. There are no known exploits in the wild reported yet.

No official patch or remediation is currently available. Users should immediately remove the 'chai-as-type' package versions 7.0.5 and 1.1.9 from their projects and avoid installing or importing this package. Verify dependencies to ensure no indirect inclusion of this malicious package. Monitor for updates from trusted sources regarding remediation or package takedown.