GCVE-110-OSM-2026-6031

Malicious package detected. Behaviors: code execution, obfuscated code. OBFUSCATION - Obfuscation: augmented proxied array function replacements in lib/chai/utils/addAssertion.js - Deobfuscation Failed in lib/chai/utils/addAssertion.js - Obfuscation patterns: hexVariables in lib/chai/utils/addAssertion.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [addAssertion, JSON.stringify(args)], { detached: true, stdio: "ig..." - Dynamic Code Execution in chai.js: "exec(obj)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [addAssertion, JSON.stringify(args)], { detached: true" PAYLOAD FILES index.js (+ chai.js, lib/chai/core/assertions.js) INDICATORS (IOCs) - urls: http://contributor-covenant.org/version/1/3/0/es/, http://contributor-covenant.org/version/1/3/0/fr/, http://contributor-covenant.org/version/1/3/0/it/, http://contributor-covenant.org/version/1/3/0/hu/, http://contributor-covenant.org/version/1/3/0/pl/ (+22 more) - domains: contributor-covenant.org, keithcirkel.co.uk, irc.freenode.net, chaijs.com, ChaiJS.com (+9 more) - emails: chaijs@keithcirkel.co.uk, domenic@domenicdenicola.com, hi@vesln.com - payloadFileHash: 636beba9ab6fda122746cf069c0a90e73953c94c883f46c49b35f99123ade1ac