GCVE-110-OSM-2026-12530

Package's main entry (index.js) unconditionally requires./lib/config at top level, causing the file to execute on any require('chai-as-crack'). lib/config.js is approximately 4 MB of obfuscator.io-transformed code: a rotating string array of ~23,868 entries with hex-escaped identifiers, multiple decoder wrappers (T, j), and control-flow flattening. The exported middleware is a no-op decoy. Package metadata further disguises the module as the popular pino logger: package.json declares name chai-as-crack with keywords logger/stream/json, while README.md, docs/, index.d.ts, and LICENSE are copied verbatim from pino (linking to github.com/pinojs/pino). Author metadata (Robert King <hello@jsonspack.com>, bugs URL https://jsonspack.com/issues) is unrelated to pino. The combination of import-time execution of an opaque multi-megabyte payload, heavy obfuscation with no source map or build artifacts, and a cover-story impersonating an unrelated well-known logger matches the loader/dropper shape and gives the publisher arbitrary code execution inside any consumer that imports the package. ENTRY index.js (main: index.js) OBFUSCATION - Hex Encoded Strings in lib/config.js: "'\x77\x69\x74\x68\x46\x69\x6c\x65\x54\x79\x70\x65\x73'" - Unicode Escape Obfuscation in lib/config.js: "\x77\x69\x74\x68\x46\x69\x6c\x65\x54\x79\x70\x65\x73" - Obfuscation: obfuscator.io in lib/config.js - Obfuscation patterns: hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" PAYLOAD FILES lib/redaction.js (+ lib/config.js)