chalk-es

{"modified":"2026-08-18T23:58:23Z","published":"2026-08-18T23:58:23Z","schema_version":"1.7.4","id":"MAL-2026-14166","summary":"Malicious code in chalk-es (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc)\nPackage name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On install the script XOR-decodes (key `stf2026`) a hardcoded GitHub URL and downloads a Windows binary to `%TEMP%\\main.exe`, then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux. The postinstall also POSTs a JSON body containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at `http://193.70.34.101:20099/vote`, serving as an install beacon/victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime specifically to hide the fetch URL and the Windows/WSL execution command.\n","affected":[{"package":{"ecosystem":"npm","name":"chalk-es"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"9c81289ea095aa745f5d06b9533c9f28df4b746dc445cec227f99dbeb1b2672e","tlsh":"00d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9"}],"package_integrity":[{"filename":"chalk-es-1.0.0.tgz","hashes":{"sha1":"454686356eaa6384547c7af31d3cf2ef967a23b4","sha512_sri":"sha512-4HxTJMpaTcz7IVHO/obBwv+K8vi+ZuBdG3eTfN5fczEh1P2UpxWJ9mXtbLEUNvGOoqrTCydwTqH1dcRrdDNDTw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-es/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018244","import_time":"2026-08-19T00:21:12.488453002Z","modified_time":"2026-08-18T23:58:23Z","sha256":"9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc","source":"amazon-inspector","versions":["1.0.0"]}]}}