The chain-chai-async package version 1.3.5 masquerades as the pino logging library by copying files from pino and exporting a similarly named middleware. Its middleware factory spawns a detached child Node.js process that ignores stdio, which fetches JSON data from a mutable, unauthenticated paste service at https://jsonkeeper.com/b/EXSIF. It extracts a 'cookie' field from the JSON response and executes it as JavaScript code with full Node.js require access, allowing an attacker to run arbitrary code on any system that installs and invokes this package. Because the remote code source is mutable and unauthenticated, the attacker can change the payload at any time without republishing the package.

Any user who installs [email protected] and calls its exported middleware risks arbitrary remote code execution on their host system. This can lead to full system compromise, data theft, or further malicious activity. The attack is triggered by invoking the middleware, and the malicious payload is controlled remotely, making it highly flexible and dangerous.

No official patch or remediation is currently documented. Users should immediately cease using [email protected] and remove it from their projects. Avoid invoking its middleware. Verify dependencies to ensure no malicious impersonation packages are included. Monitor vendor advisories for any updates or official fixes.