The express-chai package (version 3.7.9) masquerades as a legitimate Express logger middleware but includes a malicious component that decodes a base64-obfuscated URL to fetch a JSON payload from a remote server. It sends a base64-encoded secret key in the request header and extracts a 'cookie' field from the response, which it executes as code using the Function constructor with access to the local require function. This allows the remote operator to execute arbitrary code within the Node.js process that installs the middleware, compromising the host environment. The package uses naming and keywords to disguise itself as a known logging library, facilitating its distribution and installation.

Successful installation and use of express-chai version 3.7.9 results in arbitrary code execution within the Node.js process, granting an attacker full access to the require function and the surrounding application context. This can lead to complete compromise of the application and potentially the host system running the Node.js process.

No official patch or remediation is currently documented. Users should immediately avoid installing or using express-chai version 3.7.9. Remove the package from any projects and replace it with a trusted alternative. Monitor for any unexpected network connections or code execution related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.