The npm package 'chai-as-type' is a malicious package impersonating popular assertion libraries. When imported, it downloads and executes attacker-controlled JavaScript code from a remote server, enabling arbitrary code execution in the Node.js environment. The package fetches payloads from mutable public JSON paste hosts, allowing the attacker to update the malicious code dynamically without republishing the package. This behavior can lead to credential theft, persistence, and other malicious activities. The malicious code is triggered either by invoking the exported middleware or running a specific npm script. The affected versions are 7.0.5 and 1.1.9.