MAL-2026-17226
Malicious code in figlet-chalk-render (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f) The package is advertised as a chalk+figlet wrapper but index.js contains a top-level IIFE that runs on require. On Windows hosts, it reconstructs the module names 'https', 'os', 'fs', 'path', and 'child_process' and the method name 'spawn' from char-code arrays, hex escapes, and string concatenation to hide the network and execution chain. It then decodes the hardcoded plain-HTTP URL http://104.234.65.75:700/setup.exe and the filename RuntimeBroker.exe (masquerading as a legitimate Windows binary), downloads the payload into the OS temp directory via https.get piped to createWriteStream, and spawns it detached with windowsHide: true and.unref(). Execution is gated to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS are set, evading sandbox and CI analysis. The obfuscation, bare-IP plain-HTTP delivery, RuntimeBroker.exe masquerade, and CI-evasion gate are inconsistent with the package's stated purpose and match an install/require-time Windows dropper.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for figlet-chalk-render (npm). Pin to a known-safe version or switch to an alternative.