GCVE-110-OSM-2026-6032

Malicious package detected. Behaviors: code execution, obfuscated code. OBFUSCATION - Obfuscation: augmented proxied array function replacements in lib/chai/utils/addAssertion.js - Deobfuscation Failed in lib/chai/utils/addAssertion.js - Obfuscation patterns: hexVariables in lib/chai/utils/addAssertion.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [addAssertion, JSON.stringify(args)], { detached: true, stdio: "ig..." - Dynamic Code Execution in chai.js: "exec(obj)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [addAssertion, JSON.stringify(args)], { detached: true" - Brand New Package PAYLOAD FILES index.js (+ chai.js, lib/chai/core/assertions.js) INDICATORS (IOCs) - urls: http://contributor-covenant.org/version/1/3/0/es/, http://contributor-covenant.org/version/1/3/0/fr/, http://contributor-covenant.org/version/1/3/0/it/, http://contributor-covenant.org/version/1/3/0/hu/, http://contributor-covenant.org/version/1/3/0/pl/ (+22 more) - domains: contributor-covenant.org, keithcirkel.co.uk, irc.freenode.net, chaijs.com, ChaiJS.com (+9 more) - emails: chaijs@keithcirkel.co.uk, domenic@domenicdenicola.com, hi@vesln.com - payloadFileHash: e045f0b4ff409bcc00b1c2e74f687501740197295b26b41587f94c7d2f39c3d3