chalk-fancy

{"modified":"2026-05-01T13:46:20Z","published":"2026-05-01T13:46:20Z","schema_version":"1.7.4","id":"MAL-2026-3212","summary":"Malicious code in chalk-fancy (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b86a641eb2b6239d8a88849df88a1a148fa5380e3c8767dc59915edb295ef5b3)\nWhen used, package exfiltrates sensitive environmental variable.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-04-renderctx\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - files-exfiltration\n\n\n - crypto-related\n\n\n - The malicious code is intentionally included in a dependency of the package\n","affected":[{"package":{"ecosystem":"PyPI","name":"chalk-fancy"},"versions":["0.0.0","0.0.3","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]}],"references":[{"type":"WEB","url":"https://github.com/0xsebasneuron"},{"type":"WEB","url":"https://socket.dev/supply-chain-attacks/north-korea-s-contagious-interview-campaign"},{"type":"WEB","url":"https://github.com/0xsebasneuron/polymarket-arbitrage-copy-trading-bot-V2/commit/4dae9aea3c35a627a7f38a28946f73af18930a3e#diff-4d7c51b1efe9043e44439a949dfd92e5827321b34082903477fd04876edb7552"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/chalk-fancy"}],"credits":[{"name":"Kamil Mańkowski (kam193)","type":"REPORTER","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"]}],"database_specific":{"iocs":{"domains":["renderkit1.vercel.app","ctx-graphics.vercel.app"],"urls":["https://renderkit1.vercel.app","https://ctx-graphics.vercel.app"]},"malicious-packages-origins":[{"id":"pypi/2026-04-renderctx/chalk-fancy","import_time":"2026-05-01T14:29:30.463743137Z","modified_time":"2026-05-01T13:46:20.759076Z","sha256":"b86a641eb2b6239d8a88849df88a1a148fa5380e3c8767dc59915edb295ef5b3","source":"kam193","versions":["0.0.0","0.0.3","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]}]}}