The 'chain-async-dom' npm package (version 1.3.6) pretends to be a pino-compatible logger by mirroring pino's internal file structure. However, its main entry point exports a middleware function that spawns a detached subprocess executing a script (lib/vcall.js). This script retrieves JavaScript code from a hardcoded IPFS gateway URL and executes it dynamically using 'new Function.constructor', allowing the fetched code unrestricted access to the consumer's Node.js environment. Additional embedded URLs provide further mutable payload delivery mechanisms. This design enables attackers to execute arbitrary code remotely on systems that install and invoke this package as intended.

Consumers of the 'chain-async-dom' package version 1.3.6 are at risk of arbitrary remote code execution. The malicious code runs with the privileges of the Node.js process, potentially compromising the filesystem, network communications, environment variables, and overall system integrity. The attacker-controlled payload is mutable and delivered from decentralized IPFS and other URLs, making detection and mitigation more challenging.

No official patch or remediation is currently documented. Users should immediately cease using the 'chain-async-dom' package version 1.3.6 and remove it from their projects. Avoid installing or invoking this package. Monitor vendor advisories or trusted sources for any updates or official fixes. Given the nature of the malicious code, manual remediation involves removing the package and auditing affected systems for compromise.