GCVE-110-OSM-2026-8888

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 21, 2026

Malicious package detected. Behaviors: code execution, obfuscated code. ENTRY index.js (main: index.js) OBFUSCATION - Obfuscation: augmented proxied array function replacements in lib/config.js - Hex Encoded Strings in lib/config.js: "'\x6b\x67\x64\x57\x4e\x35\x73\x6e\x69\x66\x6d'" - Unicode Escape Obfuscation in lib/config.js: "\x57\x51\x42\x64\x56\x74\x61\x69\x73\x47" - Obfuscation: obfuscator.io in lib/config.js - Obfuscation patterns: hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Very New NPM Publisher Account PAYLOAD FILES lib/config.js (+ lib/redaction.js) INDICATORS (IOCs) - urls: https://www.chaijs.com/plugins/, https://www.chaijs.com/, http://192.168.1.42:9200 - domains: www.chaijs.com, YM.Eu, YM.io, Ey.io, Ey.iO (+1 more) - emails: james@abscond.org - payloadFileHash: 1176d4dea79d83166810bfe267ee4e31daa9c1b6d31c351c126bca6b1afb6a61

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	chai-as-reddit	all (affected)	—

References

Malicious npm package: chai-as-reddit

advisory

vendor

Browse GCVE Records

75,792 records in the GCVE database · Updated August 2, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON