The malicious npm package chai-chain-dom (versions 1.3.7, 1.3.8, and 1.3.9) masquerades as the pino logger but executes a detached subprocess that retrieves and evaluates remote JavaScript code from jsonkeeper.com. This code is executed with full Node.js privileges, enabling arbitrary code execution including filesystem, network, and process control. The remote payload is mutable and controlled by the attacker, making the compromise ongoing and dynamic. The package's behavior is designed to evade detection by detaching the subprocess and ignoring stdio. This results in a full system compromise upon installation and use.

Systems with the affected versions of chai-chain-dom installed or running are fully compromised, as the package executes attacker-controlled code with full Node.js capabilities. This can lead to theft or destruction of data, unauthorized network activity, and persistent backdoors. All secrets and keys stored on the compromised system are at risk and must be rotated from a secure environment. Removal of the package alone does not guarantee eradication of the attacker presence.

No official patch or fix is currently available. Immediate removal of the affected chai-chain-dom package versions (1.3.7, 1.3.8, 1.3.9) is strongly recommended. Because the package grants full system control to an attacker, assume full compromise and rotate all secrets and keys from a different, uncompromised system. Conduct a thorough incident response to identify and remediate any persistent malicious activity beyond the package itself.