GCVE-110-OSM-2026-6696

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY lib/chai-as-assured.js (main: ./lib/chai-as-assured.js) DESTINATION - custom-c2: https://amethyst-lorrin-26.tiiny.site/index.json (primary, decoded) in lib/chai-as-assured.js - custom-c2: amethyst-lorrin-26.tiiny.site (decoded) in lib/chai-as-assured.js - deobfuscated: assuredsaplus.com (fetched-payload, deobfuscated) EXFIL - Environment Variable Exfiltration in lib/chai-as-assured.js: "process.env.DEV_SECRET_VALUE); let retryCount = 5; while (retryCount > 0) { try ..." - Fetch and Eval/Exec in lib/chai-as-assured.js: "axios.get(apiEndpoint, { headers: { [apiHeaderKey]: apiHeaderValue } })).data.co..." - Network Request in lib/chai-as-assured.js: "axios.get(" OBFUSCATION - Global Variable Shadowing in lib/chai-as-assured.js: "const process = {" - Base64 Decoded Environment Variable in lib/chai-as-assured.js: "atob(process.env." - Decoded Base64 Content in lib/chai-as-assured.js - Decoded Base64 Content in [deobfuscated] lib/chai-as-assured.js - IOCs Found in Deobfuscated Code in lib/chai-as-assured.js - Dynamic Base64 Decoding in lib/chai-as-assured.js: "atob(process." - recovered 2 urls, 2 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in lib/chai-as-assured.js: "Function.constructor(" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES lib/chai-as-assured.js INDICATORS (IOCs) - urls: http://assuredsaplus.com/, http://chaijs.com/, http://www.slideshare.net/domenicdenicola/callbacks-assureds-and-coroutines-oh-my-the-evolution-of-asynchronicity-in-javascript, http://sinonjs.org/, http://mochajs.org (+4 more) - domains: domenic.me, assureds-aplus.github.io, chaijs.com, www.slideshare.net, sinonjs.org (+5 more) - emails: d@domenic.me, sam@hocevar.net - payloadFileHash: 8542f10efc33eda79dc2aa79214715e47e67c91dc5479da03d115ded42748398