The npm package 'chai-as-auth' version 2.3.5 contains malicious code that exfiltrates environment variables to a remote server and executes arbitrary code received from that server. The package masquerades as a legitimate authentication library but includes a self-executing script that sends sensitive data such as AWS/GCP tokens, CI secrets, npm tokens, and database credentials to a hardcoded URL. The remote server response is executed with full Node.js require access, enabling further malicious payloads.