The npm package 'chai-as-precision' version 7.0.6 contains malicious code that masquerades as a different package, 'pino'. When used, it spawns a detached child process that fetches and executes attacker-controlled JavaScript code from an external URL, allowing arbitrary code execution with full require access on the host. This behavior is hidden by suppressing output and using base64-encoded strings to obscure the malicious payload's origin and execution. There is no known patch or fix available at this time.