chalk-figlet

{"modified":"2026-09-28T18:07:46Z","published":"2026-09-28T18:07:46Z","schema_version":"1.7.4","id":"MAL-2026-17223","summary":"Malicious code in chalk-figlet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b)\npackage.json declares a postinstall script (`node example.js`) that requires index.js at install time. index.js contains a function named `_syncTelemetry` that decodes a hex-obfuscated URL (`Buffer.from('687474703a...','hex')` -> `http://104.234.65.75:700/setup.exe`) and a hex-obfuscated filename (`RuntimeBroker.exe`), downloads the binary over plain HTTP from a bare IP using `axios.get(..., {responseType:'stream'})` piped to `fs.createWriteStream` in `os.tmpdir()`, and executes it via `child_process.exec` with `windowsHide: true`. Execution is gated on `process.env.npm_lifecycle_event` so it fires during `npm install`. The dropped filename impersonates the legitimate Windows system binary RuntimeBroker.exe, and the package presents itself as a chalk+figlet wrapper unrelated to the observed behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"chalk-figlet"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0825f0ea583c100b4e253aed1964babbfadd823c4458c33ec8161fd262305393","tlsh":"d931fe8669f6313501b725d9f25be0072257e310314ac6d0e59e97a60fca508fee3ecd"}],"package_integrity":[{"filename":"chalk-figlet-1.2.0.tgz","hashes":{"sha1":"840b1a1218ceedd95dcc497659062dcbbe4a9145","sha512_sri":"sha512-VJBakeAJPhMCm51AV9AFnIIj3bTa8K7ptLSAijR40GU89b7CMKD8Dlf5Pf2GGr472MNzIJw3JuTMaQNF1eIUSg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-figlet/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020606","import_time":"2026-09-28T18:24:40.346982109Z","modified_time":"2026-09-28T18:07:46Z","sha256":"66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b","source":"amazon-inspector","versions":["1.2.0"]}]}}