The npm package chai-jsonss version 3.7.7 contains malicious code that executes attacker-controlled JavaScript during import. It fetches a base64-encoded payload from a remote URL, decodes it, and executes it in-process using new Function, enabling remote code execution. The package masquerades as related to chai but has no chai functionality. This behavior occurs immediately on import without user interaction.