The npm package chain-chai-async@1.3.5 impersonates the legitimate pino logging library and contains malicious code that executes attacker-controlled JavaScript remotely. When its exported middleware is invoked, it spawns a detached child process that fetches and executes code from an unauthenticated remote source, enabling arbitrary remote code execution on the host.