The npm package 'chai-as-persisted' is a malicious typosquatting package impersonating the legitimate 'chai-as-promised' package. Its postinstall script executes attacker-controlled JavaScript by decoding a hidden command-and-control URL and running code fetched from it, resulting in remote code execution (RCE) on the installer's machine. The malicious code runs detached from the install process, maintaining persistence beyond installation. Installing this package fully compromises the affected system, risking exposure of all stored secrets and keys.