GCVE-110-OSM-2026-12112

On require('chai-as-agile'), index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of process.env to that endpoint with an 'x-secret-header' header. It then passes the HTTP response body to `new Function('require', response.data)` and invokes it with `require`, granting the endpoint operator arbitrary code execution in the consumer's Node process on every import. Any credentials present in the environment (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) are transmitted verbatim to the attacker. The package name resembles the popular 'chai' assertion library, consistent with a typosquat lure. Judge assessment: The exfil file content makes the attacker model unambiguous: lib/initializeCaller.js decodes a base64-obfuscated URL (resolving to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the full contents of process.env to that endpoint on every import, then executes the HTTP response body via `new Function('require', response.data)(require)` — granting the remote operator arbitrary code execution in the consumer's Node process. This is a classic two-stage infostealer/RAT: environment exfiltration (AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI secrets) paired with a remote code execution callback. The package is brand-new (created ~10 hours ago), published by a zero-history npm account, has no source repository, and the name 'chai-as-agile' is a typosquat lure on the widely-used 'chai' assertion library. The OSV advisory MAL-2026-16207 accurately describes this behavior and is fully corroborated by the actual file content. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in lib/initializeCaller.js: "axios.post(" OBFUSCATION - Decoded Base64 Content in lib/initializeCaller.js - Decoded Base64 Content in [deobfuscated] lib/initializeCaller.js - IOCs Found in Deobfuscated Code in lib/initializeCaller.js - Dynamic Base64 Decoding in lib/initializeCaller.js: "Buffer.from(endpoint, 'base64')" - recovered 1 urls, 2 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Brand New Package - Very New NPM Publisher Account - Malicious Dependency Detected in package.json PAYLOAD FILES lib/initializeCaller.js