GCVE-110-OSM-2026-10235

This package is a trojanized clone of the chai assertion library, published by a brand-new npm account ('jordanjones', account age ~0.5 days, single package) with no source repository. The critical evidence is the obfuscated file 'lib/chai/utils/expectAssertion.js' (obfuscator.io, confidence 0.9), from which deobfuscation recovered a C2 endpoint, and a dynamic DNS host on a non-standard port, a classic attacker-controlled C2 pattern. The 'index.js' spawns a detached Node.js child process with 'stdio: ignore' and 'child.unref()', which is the canonical malware launcher pattern for running a persistent background payload that survives the parent process exit. The dependency on a known-malicious version of 'axios' further corroborates the attacker model: exfiltrate data to coolblast.zapto.org via the HTTP exfil handler, using axios as the transport, launched stealthily at install/import time. DESTINATION - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in lib/chai/utils/expectAssertion.js - Obfuscation: augmented proxied array function replacements in lib/chai/utils/expectAssertion.js - Obfuscation (osm-deobfuscator): obfuscator-io in lib/chai/utils/expectAssertion.js - Obfuscation patterns: hexVariables in lib/chai/utils/expectAssertion.js - recovered 1 urls, 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true, stdio: "ignor..." - Dynamic Code Execution in chai.js: "exec(obj)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true" - Very New NPM Publisher Account (+1 more) PAYLOAD FILES lib/chai/utils/expectAssertion.js (+ index.js)