GCVE-110-OSM-2026-6453

Steals SAUCE_ACCESS_KEY and .env file contents at require-time by concealing an obfuscated infostealer payload in lib/chai/utils/addAssertion.js that spawns a detached subprocess to exfiltrate harvested credentials to http://senpad.bounceme.net:6285/api/x-handler via dynamic DNS C2. Typosquats chai@3.8.1 with identical description and dependencies. **Trigger**: require-time — no install hooks; payload in lib/chai/utils/addAssertion.js fires on module import. **Obfuscation**: obfuscator.io RC4 rotation; zig solver decoded 32 strings revealing C2 URL (31 residual references remain). **Data harvested**: `process.env.SAUCE_ACCESS_KEY` and `.env` file contents read from disk. **Encoding**: `JSON.stringify()` serializes harvested data. **Exfil**: `spawn(detached:true).unref()` launches a background subprocess that POSTs to `http://senpad.bounceme.net:6285/api/x-handler` (dynamic DNS `senpad.bounceme.net` on non-standard port 6285). **Typosquat**: Mimics chai@3.8.1 — identical description, 7-dependency set, and 51-file structure; malicious code injected into legitimate-looking utility file. **Stage-2**: Stage chain artifacts absent; stage-2 capabilities unknown.