The 'chai-as-verified' package version 7.1.5 is a typosquatting malicious package that, upon being required, executes a middleware function spawning a detached Node.js child process. This child process retrieves a JavaScript payload from a base64-encoded URL stored in environment variables, using a base64-decoded secret header for authentication. The payload is executed dynamically with full Node.js require access, enabling arbitrary code execution. The use of base64 encoding for the C2 URL and headers is intended to evade static analysis detection.

This malicious package enables remote code execution within the Node.js environment where it is installed. The attacker can run arbitrary code with the privileges of the Node.js process, potentially leading to full system compromise, data exfiltration, or further malicious activity. Because the payload is fetched and executed dynamically, the attacker can change the behavior at will after installation.

No official patch or remediation is currently available. Users should immediately remove the 'chai-as-verified' package version 7.1.5 from their projects and replace it with the legitimate 'chai-as-promised' package or other trusted alternatives. Review dependencies for typosquatting or suspicious packages before installation. Monitor for any unexpected child processes or network connections originating from Node.js processes.