Malicious code in chai-guid (npm)

The chai-guid npm package (version 1.1.5) impersonates the pino logger and chai-guid chai plugin by copying README badges and exporting middleware as 'pino'. When this middleware is called, it spawns a detached Node.js process that fetches JavaScript code from an anonymous JSON paste host (jsonkeeper.com) and executes it using the Function constructor with full Node.js privileges and access to 'require'. A secondary command-and-control URL is embedded as a base64-encoded string in the code. This design allows an attacker to remotely execute arbitrary code on any system that installs and runs this package's middleware.

This malicious package enables remote code execution with full Node.js privileges on any system that installs and invokes the middleware, potentially allowing attackers to execute arbitrary commands, install malware, or compromise the host system. The use of an anonymous, mutable JSON paste service as a command-and-control endpoint means the attacker can dynamically update the payload executed on victims' machines.

No official patch or remediation is currently documented. Users should immediately remove the chai-guid package version 1.1.5 from their projects and avoid invoking its middleware. Consider auditing dependencies for malicious packages and replacing chai-guid with trusted alternatives. Monitor for updates from the package maintainers or npm advisories for any official fixes.