{"id":"MAL-2026-17223","summary":"Malicious code in chalk-figlet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b)\npackage.json declares a postinstall script (`node example.js`) that requires index.js at install time. index.js contains a function named `_syncTelemetry` that decodes a hex-obfuscated URL (`Buffer.from('687474703a...','hex')` -\u003e `http://104.234.65.75:700/setup.exe`) and a hex-obfuscated filename (`RuntimeBroker.exe`), downloads the binary over plain HTTP from a bare IP using `axios.get(..., {responseType:'stream'})` piped to `fs.createWriteStream` in `os.tmpdir()`, and executes it via `child_process.exec` with `windowsHide: true`. Execution is gated on `process.env.npm_lifecycle_event` so it fires during `npm install`. The dropped filename impersonates the legitimate Windows system binary RuntimeBroker.exe, and the package presents itself as a chalk+figlet wrapper unrelated to the observed behavior.\n","modified":"2026-09-28T18:30:06.490177060Z","published":"2026-09-28T18:07:46Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.2.0"],"id":"IN-MAL-2026-020606","import_time":"2026-09-28T18:24:40.346982109Z","modified_time":"2026-09-28T18:07:46Z","sha256":"66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-figlet/v/1.2.0"}],"affected":[{"package":{"name":"chalk-figlet","ecosystem":"npm","purl":"pkg:npm/chalk-figlet"},"versions":["1.2.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"chalk-figlet-1.2.0.tgz","hashes":{"sha1":"840b1a1218ceedd95dcc497659062dcbbe4a9145","sha512_sri":"sha512-VJBakeAJPhMCm51AV9AFnIIj3bTa8K7ptLSAijR40GU89b7CMKD8Dlf5Pf2GGr472MNzIJw3JuTMaQNF1eIUSg=="}}],"evidence_files":[{"tlsh":"d931fe8669f6313501b725d9f25be0072257e310314ac6d0e59e97a60fca508fee3ecd","path":"index.js","sha256":"0825f0ea583c100b4e253aed1964babbfadd823c4458c33ec8161fd262305393"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalk-figlet/MAL-2026-17223.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}