{"id":"MAL-2026-4517","summary":"Malicious code in chalk-tempalte (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3e82f6fa2867575be5e57fd3b03dada6a93761c97b240f77f98f4b221bde7a7)\nPackage name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm utility), consistent with deliberate typosquatting. The tarball ships a `postinstall.js` lifecycle script that imports `child_process`, performs HTTP GET/POST traffic via `http.request(...)`, and collects host identifiers (`hostname:` fields appear repeatedly throughout the script at lines 20, 46, 287, 409, 427). A second large file, `phantom.js`, contains multiple POST sinks (lines 1807, 2113, 3183, 6795, 6852). The structural shape — typosquat name + postinstall script that combines child_process, outbound HTTP, and host/system metadata harvesting — matches the credential/host-data exfiltration pattern used by recent npm supply-chain campaigns. Installing this package causes the postinstall hook to fire automatically on `npm install`, transmitting installer machine data to a remote endpoint and providing a foothold for further code execution.\n","aliases":["GHSA-hvjp-xq9w-c33f"],"modified":"2026-09-01T11:31:30.452575832Z","published":"2026-05-20T02:07:31Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.15"],"id":"IN-MAL-2026-003421","import_time":"2026-05-26T05:50:36.703635173Z","modified_time":"2026-05-20T02:32:48Z","sha256":"0dbbedbc9885ab0402df3ea58ad1e3efbe33154089e167af2a7493174fa8168a","source":"amazon-inspector"},{"id":"IN-MAL-2026-003409","import_time":"2026-05-26T05:50:35.388926785Z","modified_time":"2026-05-20T02:21:45Z","sha256":"1b46901047e08017bf0dd3a8edddd3b5b41b2bfc568487dd4420e37b07fb2b58","source":"amazon-inspector","versions":["1.0.16"]},{"source":"amazon-inspector","versions":["1.0.14"],"id":"IN-MAL-2026-003411","import_time":"2026-05-26T05:50:35.678873968Z","modified_time":"2026-05-20T02:22:40Z","sha256":"1b69dc559752cb056e834f5687f268e935b373bbe24c3499738601be672f87f9"},{"source":"amazon-inspector","versions":["1.0.17"],"id":"IN-MAL-2026-003414","import_time":"2026-05-26T05:50:35.985579113Z","modified_time":"2026-05-20T02:27:06Z","sha256":"b61844f5e8edacf86401cbc715ec84fae400cc29417b3c10993d3e1314ce13ff"},{"sha256":"d3e82f6fa2867575be5e57fd3b03dada6a93761c97b240f77f98f4b221bde7a7","source":"amazon-inspector","versions":["1.0.19"],"id":"IN-MAL-2026-003393","import_time":"2026-05-26T05:50:33.402887211Z","modified_time":"2026-05-20T02:07:31Z"},{"versions":["1.0.16"],"id":"IN-MAL-2026-003408","import_time":"2026-05-26T05:50:35.279050957Z","modified_time":"2026-05-20T02:21:44Z","sha256":"ec649aaa3ddfd4426b0b4076c10d98e3caac8efdee798007423b49a89cff2d15","source":"amazon-inspector"},{"modified_time":"2026-05-20T18:45:16Z","sha256":"788cdc2d5da13ef256deec3bef835fef1f62c28ae9ae77606677951f615dba12","source":"amazon-inspector","versions":["1.0.20"],"id":"IN-MAL-2026-003592","import_time":"2026-05-26T05:50:55.34748867Z"},{"modified_time":"2026-05-20T02:32:48Z","sha256":"a50750faf25ea435dbed1d83e0bb3ae9bcad627770fcbe1213fcde2c5e168d86","source":"amazon-inspector","versions":["1.0.15"],"id":"IN-MAL-2026-003420","import_time":"2026-05-26T05:50:36.602438299Z"},{"id":"IN-MAL-2026-003410","import_time":"2026-05-26T05:50:35.552335864Z","modified_time":"2026-05-20T02:22:40Z","sha256":"c0ffe3887c093cd245be6407cffd38d98851d4c4aaae87dad81a0cbf9376e8a4","source":"amazon-inspector","versions":["1.0.14"]},{"sha256":"de2bc8855ed757642753f9c434aaf3a48b1a8806176970046b851433c66ba154","source":"amazon-inspector","versions":["1.0.17"],"id":"IN-MAL-2026-003415","import_time":"2026-05-26T05:50:36.085632616Z","modified_time":"2026-05-20T02:27:06Z"},{"id":"RLMA-2026-05020","import_time":"2026-07-09T09:16:25.076316821Z","modified_time":"2026-07-07T12:44:05Z","sha256":"6fcdc3e28182221fd505c5d00cd81c1bc468f1d62d386231055a178fedbebcf5","source":"reversing-labs","versions":["1.0.14","1.0.15","1.0.16","1.0.17","1.0.19","1.0.20"]},{"sha256":"f2f45ab6c61262119804821e85e2eba8a634607a663f46f63f67c89c51be76c6","source":"reversing-labs","id":"RLUA-2026-06152","import_time":"2026-09-01T11:18:00.347075782Z","modified_time":"2026-08-24T16:44:14Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/chalk-tempalte/v/1.0.14"},{"type":"WEB","url":"https://www.ox.security/blog/new-actors-deploy-shai-hulud-clones-teampcp-copycats-are-here"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hvjp-xq9w-c33f"}],"affected":[{"package":{"name":"chalk-tempalte","ecosystem":"npm","purl":"pkg:npm/chalk-tempalte"},"versions":["1.0.15","1.0.16","1.0.14","1.0.17","1.0.19","1.0.20"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalk-tempalte/MAL-2026-4517.json","indicators":{"domains":["api.ipify.org","b94b6bcfa27554.lhr.life"],"evidence_files":[{"tlsh":"218230a103f615650d63ddadeb4350016922d2433900b95c7fed6fc82f1b52eaaf2bb8","path":"postinstall.js","sha256":"ffba9bdd6793edd5b38e12900252c1813a693f59c25af51c3b658cf3f27b6162"}],"package_integrity":[{"filename":"chalk-tempalte-1.0.17.tgz","hashes":{"sha1":"de43a8c6ffd8984edfce333242997184360afe1e","sha512_sri":"sha512-LTXWiDvzVb76+cSz4H38Xgw58ZQrbY0eMVpoh3kBBGrflw5/yxogb066CZNNHgIDG4QInxxqowCHF3pKJH1X0A=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}