The npm package chai-assertions-plus masquerades as a Chai assertions extension but contains unrelated filler code and a malicious payload. Upon requiring the package, a top-level immediately invoked function expression (IIFE) shadows the global process object with a fake object whose environment fields hold base64-encoded strings. These strings decode at runtime to form a destination URL and an HTTP header. The package performs an axios GET request to this URL, then executes the returned response body as code via new Function("require", response), passing the real require function. This allows arbitrary code execution with the package's require capability on the user's machine every time the module is imported. The mismatch between the package name/description and the code, as well as the obfuscated endpoint and headers, indicate intentional malicious behavior rather than misconfiguration.

This malicious package enables arbitrary code execution on any system that installs and imports it, potentially allowing attackers to execute any code with the privileges of the user running the Node.js process. This can lead to system compromise, data theft, or further malware deployment. The attack is triggered automatically on import, increasing risk of unnoticed exploitation.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing chai-assertions-plus versions 6.0.5 and 6.0.6. Remove the package from existing projects and replace it with a trusted alternative. Monitor for any unexpected network requests or code execution related to this package. Check vendor advisories or npm security advisories for updates or official guidance.