The npm package 'chain-async-dom' version 1.3.6 masquerades as a pino-compatible logger but contains malicious code that fetches and executes attacker-controlled JavaScript from an IPFS gateway. This results in arbitrary remote code execution with full access to the Node.js runtime, filesystem, network, and environment of the consumer. The package also includes additional mutable payload channels via embedded URLs, increasing the attack surface.