The npm package 'chai-smart' version 2.3.5 contains malicious code that masquerades as a pino-like logger API. It spawns a detached Node.js child process that decodes a hardcoded URL and sends the full environment variables of the consuming process to an attacker-controlled endpoint. The response from this endpoint is executed as arbitrary code within the consumer's Node.js process, enabling both credential exfiltration and remote code execution.