The npm package chai-as-balanced is a malicious typosquat of chai-as-promised that executes attacker-controlled code. It fetches a remote payload from an anonymous, mutable JSON storage service and executes it with full Node.js privileges, allowing arbitrary code execution. The malicious code runs in a detached child process, hiding its activity from the user. This threat affects version 2.2.3 of chai-as-balanced. There is no official patch or remediation guidance provided.