MAL-2026-14166
Malicious code in chalk-es (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc) Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On install the script XOR-decodes (key `stf2026`) a hardcoded GitHub URL and downloads a Windows binary to `%TEMP%\main.exe`, then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux. The postinstall also POSTs a JSON body containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at `http://193.70.34.101:20099/vote`, serving as an install beacon/victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime specifically to hide the fetch URL and the Windows/WSL execution command.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chalk-es (npm). Pin to a known-safe version or switch to an alternative.