The npm package chai-as-sets version 3.1.3 contains malicious code that executes upon module load. It spawns a detached child process which decodes a hardcoded URL and sends the installer's environment variables to a remote server. The server's response is executed as code with access to the package's require function, enabling arbitrary remote code execution. The package attempts to disguise itself by impersonating another library (pino).