{"id":"MAL-2026-14168","summary":"Malicious code in chalk-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4)\nchalk-util@1.0.0 is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm install, postinstall XOR-decodes an obfuscated URL (key 'stf2026') pointing to an https://github.com/... asset, downloads it to %TEMP%\\main.exe on Windows (and via a decoded PowerShell bridge command on WSL-detected Linux, identified through /proc/version), and spawns it detached with a hidden window. The same postinstall reconstructs the bare IP 193.70.34.101 via ['193','70','34','101'].join('.') and POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote over plain HTTP as an install beacon. Four separate byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime to hide the fetch URL and the shell command passed to exec(). The auto-execute-on-default-install gate is satisfied via the postinstall lifecycle hook; the fetched binary contents are attacker-controlled and unverified.\n","modified":"2026-08-19T00:30:12.878434810Z","published":"2026-08-18T23:59:14Z","database_specific":{"malicious-packages-origins":[{"sha256":"4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018250","import_time":"2026-08-19T00:21:13.04425525Z","modified_time":"2026-08-18T23:59:14Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-util/v/1.0.0"}],"affected":[{"package":{"name":"chalk-util","ecosystem":"npm","purl":"pkg:npm/chalk-util"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"b2d13fca1ef59035874bf96884cf9d13b2a6c207320e4a65ff8f42107f5793c85a69e9","path":"scripts/postinstall.js","sha256":"84f5723a8c602913eba8f239a6cd19485dc399ef40ad4ec7eb1dfd031bfd6582"},{"sha256":"ac13991093efce1485ecbfa7fa9fa75895e04161fd015d3699fbd07179e829ec","path":"index.js"}],"package_integrity":[{"filename":"chalk-util-1.0.0.tgz","hashes":{"sha512_sri":"sha512-GBRHQkJ4Mx5VmX7k2DfCjOJN35AGefwek6h3ctiFVefVJVzwDfqTsrdLyZHOelcX3iMIUE5/4j9ghMKGA/AxOg==","sha1":"cd4b0a5fff912d48ca5a647cb46c048b91c51eba"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalk-util/MAL-2026-14168.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}