GCVE-110-OSM-2026-9576

Executes an unauthorized package-manager command when loaded as the main program. Top-level package behavior invokes npm with the install subcommand to install a fixed set of four dependencies, causing unrequested command execution during initialization. ## What it does When chai-as-map 2.3.5 runs as the main program, top-level package logic invokes npm with the install subcommand to install a fixed set of four dependencies. Loading the package therefore performs unrequested initialization through a package-manager command, making the command execution unauthorized. ## Execution path ### Code evidence: Process execution - **Trigger:** main entry — The package main entry reaches this evidence. #### Trigger-to-sink path 1. **Invoke process:** Runs npm install for the fixed dependency set: sql.js, socket.io-client, form-data, axios. #### Code locations **package/lib/config.js** — line 1, UTF-8 byte column 1098822 to line 1, UTF-8 byte column 1100063 (end-exclusive) Exact excerpt start: ``` execSync(uz(-0xe79,0x102,0xef3,0x52a,0x2eaf)+uf(0x37c5,0x220b,0x3914,0x298a,0x5acb)+uU(0x3e5f,0x2492,0x2f40,'\x65\x36\x59\x71',0x1cd2)+m2(-0x17e7,-0x1910,0x8a9,'\x72\x67\x50\x5a',0x1056)+uh(0x5690,0x6707,0x4038,0x4f8f,0x292e)+uU(0x1c43,0x179e,0x10e4,'\x4d\x23\x39\x4f',0x1fdd)+uH('\x46\x40\x50\x4d',0xf5e,0x315f,0x1f51,0 ``` _Middle omitted from this public display: 201 exact UTF-8 bytes._ Exact excerpt end: ``` ,'\x72\x48\x5e\x76',0x6c60,0x4148)+m5(-0x15cf,0xf87,0x2125,-0x1daf,'\x6f\x33\x5d\x4d')+m1(0x4d3d,0x297b,0x4335,0x3b16,0x3a22)+uz(0x3065,0x50d4,0xdf7,0x27c2,0x2bd2)+uz(0x1ae3,0x14e5,0x89,0x1f4a,0x3ce6)+uZ(0x4e70,0x3491,'\x39\x42\x43\x5d',0x27ea,0x44f3)+uG(0x3406,0x89f,0x3fe7,0x3e62,0x3727)+m3(0x4130,0x5116,'\x39\x42\x43\x5d',0x61dd,0x6dc4)+uZ(0x1872,0x33e7,'\x6b\x78\x37\x68',0x2f1a,0x1fa6)+m0(0x1aef,0x8b0,-0x24c1,0x1229,0x2c52)+'\x6e\x74',{'\x73\x74\x64\x69\x6f':[up(0x4c68,0x24e8,0x3730,0x4987,0xca8),m7(0x43d4,0x3d73,'\x21\x76\x6b\x25',0x3140,0x3f23),uO(0x350c,0x1534,0x2906,0x22cf,0x4c6e)],'\x6d\x61\x78\x42\x75\x66\x66\x65\x72':(-0x1b93+0x4a9+0x1aea)*(-0x10e7+-0x47*0x14+0x1a73)*(-0xeef*0x2+-0x1e94+-0x8a4*-0x7)}) ``` ## Impact and scope - This package is not shown stealing credentials, collecting files, or exfiltrating data. - Findings come from static analysis of `chai-as-map@2.3.5`; the package was not executed.