The async-chain-dom npm package version 1.3.5 contains malicious code that executes arbitrary JavaScript fetched from a remote attacker-controlled server. Upon requiring the package, it spawns a detached child Node.js process that continuously fetches and executes code from a mutable remote JSON endpoint. The package masquerades as the pino logger to deceive developers. This behavior allows persistent remote code execution within the Node.js environment of the consumer.