The npm package chai-as-align version 7.1.0 is a typosquatting malicious package that executes remote code on the installer's machine. It spawns a detached Node.js child process that fetches and executes attacker-controlled code from a hidden URL, enabling full remote code execution when the middleware is invoked.