GCVE-110-OSM-2026-11412

Executes a fixed npm install command for four dependencies when chaikit 2.3.5 loads through its main entry and loading one of the bootstrap dependencies throws. This package-manager fallback is unauthorized because package initialization imposes an unrequested dependency installation. ## What it does Loading chaikit 2.3.5 through its main entry activates package logic. If loading one of the bootstrap dependencies throws, top-level logic uses synchronous process execution to launch a fixed npm install command for four dependencies. This unrequested initialization imposes an unauthorized dependency installation. ## Execution path ### Code evidence: Process execution - **Trigger:** main entry — The package main entry reaches this evidence. - **Conditions:** The package-manager fallback runs only if loading one of the bootstrap dependencies throws. #### Trigger-to-sink path 1. **Invoke process:** Runs npm install for the fixed dependency set: sql.js, socket.io-client, form-data, axios. #### Code locations The locations below are exact bytes from the published package that support the resolved operation above. **package/index.js** — line 6, UTF-8 byte column 16 to line 6, UTF-8 byte column 39 (end-exclusive) ``` require('./lib/config') ``` **package/lib/config.js** — line 1, UTF-8 byte column 1620149 to line 1, UTF-8 byte column 1620158 (end-exclusive) ``` catch(z){ ``` **package/lib/config.js** — line 1, UTF-8 byte column 1620162 to line 1, UTF-8 byte column 1621421 (end-exclusive) Exact excerpt start: ``` execSync(ml(-0x1046,'\x71\x5d\x47\x44',0x60d,0x2dd1,0x345d)+mA(0x2cce,0x551,0x287c,'\x34\x62\x4a\x36',0x400c)+ml(0x6a10,'\x54\x75\x77\x42',0x54c3,0x79a2,0x75ad)+mL('\x28\x6e\x61\x6c',0x5075,0x4035,0x151a,0x38d5)+ml(-0x4e0,'\x4e\x5b\x6c\x4a' ``` _Middle omitted from this public display: 659 exact UTF-8 bytes._ Exact excerpt end: ``` ',0xbbc,0x38c6,-0x1193,-0x17be)+mc(0x35ee,0x42ee,0x4da8,0x215c,0x16a4)+'\x6e\x74',{'\x73\x74\x64\x69\x6f':[mt(0x805f,0x51b3,0x47fd,0x5a90,0x5221),mC(0x3c2b,0x3af5,'\x51\x44\x61\x4a',0x2057,-0x5d1),mc(0x574e,0x34a9,0x3a6b,0x773d,0x3f39)],'\x6d\x61\x78\x42\x75\x66\x66\x65\x72':(0x1577+-0x11cf+0x8*0xb)*(0x25*-0x59+-0x96+-0x5d1*-0x3)*(-0x1f17+0x3*0x3db+0x1390)}) ``` ## Impact and scope - The selected source-to-sink evidence does not establish a complete credential- or file-data-to-network exfiltration path. - Findings come from static analysis of `chaikit@2.3.5`; the package was not executed.