The 'chai-smart' npm package (version 2.3.5) exports middleware that launches a detached Node.js child process running a script which base64-decodes a hardcoded URL. This script sends a POST request containing the entire environment variables of the consumer process to an attacker-controlled server. The server's response is then executed dynamically as JavaScript code with access to the package's require function. This results in two simultaneous malicious actions: exfiltration of sensitive environment data (such as cloud credentials, tokens, and database passwords) and arbitrary code execution within the consumer's Node.js environment. The package's name and description are deceptive, serving as a cover for this malicious behavior.

This vulnerability allows attackers to exfiltrate sensitive environment variables from the victim's process, potentially exposing cloud credentials, tokens, and database passwords. Additionally, it enables arbitrary code execution within the consumer's Node.js process, which could lead to full system compromise or further malicious activities. The severity is critical due to the combination of data theft and remote code execution.

No official patch or remediation is currently documented. Users should immediately remove or avoid using the 'chai-smart' package version 2.3.5. Since the package is malicious by design, replacing it with a trusted alternative and auditing systems for potential compromise is recommended. Monitor vendor advisories for any updates or official fixes.