GCVE-110-OSM-2026-5858

Malicious package detected. Behaviors: code execution, obfuscated code. Payload: index.js Secondary files: chai.js, lib/chai/core/assertions.js Key findings: - Stealth Background Process Spawning in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true, std..." - Dynamic Code Execution in chai.js: "exec(obj)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true" IOCs: - urls: http://contributor-covenant.org/version/1/3/0/es/, http://contributor-covenant.org/version/1/3/0/fr/, http://contributor-covenant.org/version/1/3/0/it/, http://contributor-covenant.org/version/1/3/0/hu/, http://contributor-covenant.org/version/1/3/0/pl/ (+22 more) - domains: contributor-covenant.org, keithcirkel.co.uk, irc.freenode.net, chaijs.com, ChaiJS.com (+9 more) - emails: chaijs@keithcirkel.co.uk, domenic@domenicdenicola.com, hi@vesln.com - payloadFileHash: a1dd05076258a140f526125300412b0693462f4f0adcb50d7754af5676ff85ae