The chai-jsonss npm package version 3.7.7 includes malicious code that, upon import, calls a function postCallers() which decodes a base64 URL from its internal constants. It then performs an HTTP GET request to this URL using axios, retrieves a base64-encoded JavaScript payload from the response, decodes it, and executes it dynamically via new Function(require). This results in execution of attacker-controlled code within the importing process. The remote payload URL is obfuscated as a shortlink and stored in a fake process.env-like local module field named DEV_API_KEY. The package name is deceptive, resembling the legitimate chai package but containing no chai-related code, only this malicious fetch-and-execute behavior.

This malicious package enables remote code execution in any environment that imports chai-jsonss version 3.7.7, potentially allowing attackers to execute arbitrary code with the privileges of the importing process. This can lead to full system compromise, data theft, or further malware deployment. The attack is triggered automatically on import, requiring no additional user action.

No official patch or remediation is currently documented. Users should immediately remove and avoid using chai-jsonss version 3.7.7. Audit dependencies for this package and replace it with trusted alternatives. Monitor for any unexpected network activity or code execution related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.