GCVE-110-OSM-2026-7963

Malicious package detected. Behaviors: code execution, obfuscated code. OBFUSCATION - Obfuscation: augmented proxied array function replacements in lib/chai/utils/assertion.js - Deobfuscation Failed in lib/chai/utils/assertion.js - Obfuscation patterns: hexVariables in lib/chai/utils/assertion.js ADDITIONAL FINDINGS - Stealth Background Process Spawning in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true, stdio: "ignor..." - Dynamic Code Execution in chai.js: "exec(obj)" - Shell Command Execution in index.js: "require("child_process")" - Silent Process Execution in index.js: "stdio: "ignore"" - Detached Child Process Payload in index.js: "spawn("node", [assertion, JSON.stringify(args)], { detached: true" PAYLOAD FILES index.js (+ chai.js, lib/chai/core/assertions.js) INDICATORS (IOCs) - urls: http://contributor-covenant.org/version/1/3/0/es/, http://contributor-covenant.org/version/1/3/0/fr/, http://contributor-covenant.org/version/1/3/0/it/, http://contributor-covenant.org/version/1/3/0/hu/, http://contributor-covenant.org/version/1/3/0/pl/ (+24 more) - domains: contributor-covenant.org, keithcirkel.co.uk, irc.freenode.net, chaijs.com, ChaiJS.com (+9 more) - emails: chaijs@keithcirkel.co.uk, domenic@domenicdenicola.com, hi@vesln.com - payloadFileHash: a1dd05076258a140f526125300412b0693462f4f0adcb50d7754af5676ff85ae