chalk-util

{"modified":"2026-08-18T23:59:14Z","published":"2026-08-18T23:59:14Z","schema_version":"1.7.4","id":"MAL-2026-14168","summary":"Malicious code in chalk-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4)\nchalk-util@1.0.0 is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm install, postinstall XOR-decodes an obfuscated URL (key 'stf2026') pointing to an https://github.com/... asset, downloads it to %TEMP%\\main.exe on Windows (and via a decoded PowerShell bridge command on WSL-detected Linux, identified through /proc/version), and spawns it detached with a hidden window. The same postinstall reconstructs the bare IP 193.70.34.101 via ['193','70','34','101'].join('.') and POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote over plain HTTP as an install beacon. Four separate byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime to hide the fetch URL and the shell command passed to exec(). The auto-execute-on-default-install gate is satisfied via the postinstall lifecycle hook; the fetched binary contents are attacker-controlled and unverified.\n","affected":[{"package":{"ecosystem":"npm","name":"chalk-util"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"84f5723a8c602913eba8f239a6cd19485dc399ef40ad4ec7eb1dfd031bfd6582","tlsh":"b2d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9"},{"path":"index.js","sha256":"ac13991093efce1485ecbfa7fa9fa75895e04161fd015d3699fbd07179e829ec"}],"package_integrity":[{"filename":"chalk-util-1.0.0.tgz","hashes":{"sha1":"cd4b0a5fff912d48ca5a647cb46c048b91c51eba","sha512_sri":"sha512-GBRHQkJ4Mx5VmX7k2DfCjOJN35AGefwek6h3ctiFVefVJVzwDfqTsrdLyZHOelcX3iMIUE5/4j9ghMKGA/AxOg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-util/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018250","import_time":"2026-08-19T00:21:13.04425525Z","modified_time":"2026-08-18T23:59:14Z","sha256":"4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4","source":"amazon-inspector","versions":["1.0.0"]}]}}