GCVE-110-OSM-2026-10257

This package is a trojanized clone of the chai assertion library, published under the typosquatting name 'js-assert-plus' with minimal metadata and no repository. The critical finding is that deobfuscation of lib/chai/utils/assertion.js (obfuscator.io, confidence 0.9, 181 hex-variable names) recovered a hidden C2 endpoint and a dynamic DNS domain consistent with attacker-controlled infrastructure, not any legitimate service. The index.js file contains hex-encoded strings that decode to child_process references and silently spawns processes with stdio:'ignore' to suppress output, indicating a stealthy execution chain. The declared 'axios' dependency is itself flagged as known malicious. The attacker model is a supply-chain implant that uses the chai library as cover while injecting an obfuscated payload that phones home to a C2 domain. DESTINATION - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in lib/chai/utils/assertion.js - Obfuscation: augmented proxied array function replacements in lib/chai/utils/assertion.js - Obfuscation (osm-deobfuscator): obfuscator-io in lib/chai/utils/assertion.js - Decoded Hex String Content in index.js (x2) - Obfuscation patterns: hexVariables in lib/chai/utils/assertion.js - recovered 1 urls, 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in chai.js: "exec(obj)" - Silent Process Execution in index.js: "stdio: "ignore"" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/chai/utils/assertion.js