GCVE-110-OSM-2026-6401

Hijacks the Ethereum developer toolchain by cloning the legitimate eth-gas-reporter codebase and injecting a single unconditional require('chai-assert-kit') at module load time at index.js line 127 to load a separate stage-2 payload package. The stage-2 package chai-assert-kit was not available for analysis at detection time so terminal capabilities are unknown. Published by an unrelated actor (antonost) squatting on the eth-gas-reporter name targeting Hardhat and Truffle test suite users. **Trigger**: require-time — `require('chai-assert-kit')` injected at `index.js:127` between `inherits(Gas, Base)` and `module.exports`; fires unconditionally when any consumer requires the package. No install hook. **Trojan technique**: Full verbatim copy of the legitimate eth-gas-reporter codebase by cgewecke with a single injected line to evade static detection. **Stage payload**: `chai-assert-kit` — not published on npm at analysis time (0 versions, null publisher); stage chain unresolved; terminal capabilities unknown. **Name squatting**: Package name `ethereum-gas-reporter` mimics the well-known `eth-gas-reporter`; legitimate GitHub repo URL copied to appear authentic. **Target audience**: Ethereum developers using Hardhat/Truffle test suites that declare `ethereum-gas-reporter` as a test dependency.