Malicious code in chalk-core (npm)

chalk-core@1.0.0 is a typosquatting attack targeting the widely-used chalk npm package. The malicious package exports an empty object and contains no legitimate chalk functionality.

The attack is delivered via a postinstall script (scripts/postinstall.js) that executes automatically on npm install. The script uses XOR encoding (key 'stf2026') to obfuscate a hidden URL and fetches an executable to %TEMP%\main.exe on Windows systems, then launches it with detached process spawning and hidden windows. No hash or signature verification is performed on the downloaded payload.

For systems running under Windows Subsystem for Linux (WSL), the script detects the virtualized environment by inspecting /proc/version, /proc/sys/kernel/osrelease, and WSL environment variables, then executes a XOR-decoded bridge command that reaches from the Linux guest to the Windows host to fetch and execute the same payload.

Before payload delivery, the postinstall script beacons to http://193.70.34.101:20099/vote (an install-tracker and potential kill-switch server) by assembling the IP address from a string-array literal and POSTing the host platform information. Multiple XOR-encoded byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are used to hide the download URL and shell commands from casual code inspection.