If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (ae73388f2a877d421e53b37bdd36496a8048149ffe2e64a975e87c705f8b0e45)
The package impersonates chai-as-promised and copies its README from pino, but its exported middleware spawns a detached `node lib/caller.js` process. caller.js base64-decodes a hardcoded jsonstorage.net URL (concealed together with an `x-secret-key` header name/value as base64 literals in a synthetic `process.env` object decoded with `atob`), fetches the JSON response, and passes its `cookie` field to `new Function.constructor("require", s)(require)`, executing attacker-controlled JavaScript in the host Node.js process with access to `require`. The remote payload is mutable and can be changed by the operator of the storage URL at any time.