The 'chain-chai-await' package mimics the legitimate pino logger's file structure and API but is unrelated to the real pino package. When used, it spawns a detached Node subprocess that fetches JavaScript code from https://jsonkeeper.com/b/K80JD and executes it via a new Function constructor, enabling arbitrary remote code execution with full require access. It retries the fetch up to five times and uses a base64-encoded backup URL and secret header key/value to support this behavior. This design indicates a deliberate dropper mechanism hidden behind a logging library facade.

Consumers of the affected 'chain-chai-await' package versions are subject to arbitrary remote code execution within their Node.js environment. This can lead to full compromise of the application and potentially the host system, as the malicious code runs with the privileges of the Node process and has unrestricted access to require modules.

No official patch or remediation is currently documented. Users should immediately remove and replace the 'chain-chai-await' package from their dependencies. Avoid using this package entirely and verify the authenticity of logging libraries. Monitor for any unexpected network requests to jsonkeeper.com or similar endpoints from Node.js processes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.