chalkdev

{"modified":"2026-07-14T14:00:35Z","published":"2026-07-14T14:00:35Z","schema_version":"1.7.4","id":"MAL-2026-10583","summary":"Malicious code in chalkdev (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619)\nchalkdev is a near-empty package (index.js exports {}, 11-byte README) whose sole runtime behavior is a postinstall hook that runs `.init.js` on `npm install`. `.init.js` enumerates installer-side secret environment variables (including NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, STRIPE_*, DB_PASSWORD, GOOGLE_APPLICATION_CREDENTIALS), reads credential files from the user's home directory (`~/.npmrc`, `~/.env`, `~/.env.local`, `~/.env.production`, `~/config.json`, `~/credentials.json`), and scans `~/.config` for filenames containing `token`, `cred`, or `secret`. It also collects host identifiers via `os.hostname()` and `os.platform()`. The harvested data is POSTed as JSON to a hardcoded `https://webhook.cool/at/tender-deer-80/...` endpoint. The package name typosquats the popular `chalk` library.\n","affected":[{"package":{"ecosystem":"npm","name":"chalkdev"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":".init.js","sha256":"6eb3939e40f85d1c3f591a3cd3a3edf0fd00c9b09fd7cb48f62e11edca3219b2","tlsh":"d9513181849e521310db2af168034c00a67ee59b3435e6e17e8f02249fddc6c85b3fbd"},{"path":"package.json","sha256":"784018fcf04758b87e610372d2b3adfedeeefca083930727e76b23fa91f83ba1","tlsh":"2ac08c072b006e33444c4ea47d258a5c51e74370106da32884eb593443e16aa8a4e41b"}],"package_integrity":[{"filename":"chalkdev-1.0.0.tgz","hashes":{"sha1":"6f1f6ed218df6a3d6801baca18b527bcb9d9eec5","sha512_sri":"sha512-/fBye1AIHOb62/jmWZbEH8u1Ova8CKCoPrV004mmLUByhTzdZSUpNt+0Rh4ELDQ5ACy29wZhXOFBp8Ttw7vrsQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalkdev/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010519","import_time":"2026-07-14T14:37:52.809026444Z","modified_time":"2026-07-14T14:00:35Z","sha256":"31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619","source":"amazon-inspector","versions":["1.0.0"]}]}}