{"id":"MAL-2026-17226","summary":"Malicious code in figlet-chalk-render (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f)\nThe package is advertised as a chalk+figlet wrapper but index.js contains a top-level IIFE that runs on require. On Windows hosts, it reconstructs the module names 'https', 'os', 'fs', 'path', and 'child_process' and the method name 'spawn' from char-code arrays, hex escapes, and string concatenation to hide the network and execution chain. It then decodes the hardcoded plain-HTTP URL http://104.234.65.75:700/setup.exe and the filename RuntimeBroker.exe (masquerading as a legitimate Windows binary), downloads the payload into the OS temp directory via https.get piped to createWriteStream, and spawns it detached with windowsHide: true and.unref(). Execution is gated to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS are set, evading sandbox and CI analysis. The obfuscation, bare-IP plain-HTTP delivery, RuntimeBroker.exe masquerade, and CI-evasion gate are inconsistent with the package's stated purpose and match an install/require-time Windows dropper.\n","modified":"2026-09-28T18:30:05.543300447Z","published":"2026-09-28T18:07:55Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-28T18:07:55Z","sha256":"992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f","source":"amazon-inspector","versions":["1.2.1"],"id":"IN-MAL-2026-020607","import_time":"2026-09-28T18:24:40.544400227Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/figlet-chalk-render/v/1.2.1"}],"affected":[{"package":{"name":"figlet-chalk-render","ecosystem":"npm","purl":"pkg:npm/figlet-chalk-render"},"versions":["1.2.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/figlet-chalk-render/MAL-2026-17226.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b07a748c696cdd82d0e1b600e32a8539eedfb6511556c9817770e06d3ac36e61","tlsh":"0041d006b9fb71310177b0e2a317542a2256e90332c9c2e07b9d9359afca235e5d36dc"}],"package_integrity":[{"filename":"figlet-chalk-render-1.2.1.tgz","hashes":{"sha1":"fb61281c5aa920799c26e5ac55efb0c68cc9970a","sha512_sri":"sha512-47jYuE2NQLtCPLZaXzh2hE6QNXhLojy58//4b3CKvDmWdPaveUVDCAJWLdIwNVtn9VkH7XSO+rxnYiFtSooZAg=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}