Malicious code in chalk-es (npm)
The npm package chalk-es, a typosquat of the legitimate chalk library, contained malicious postinstall code that downloads and executes a Windows binary and beacons install events to a remote IP. The package ships an empty library body with all malicious behavior hidden in scripts/postinstall.js.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on installation count of chalk-es before removal
- Ecosystems
- Attack vectors
- Affected entities
- chalk-esnpm package mimicking chalk
The npm package chalk-es is a typosquat of the legitimate chalk library. Rather than providing the expected functionality, the package contains only an empty library body with all real behavior implemented in scripts/postinstall.js.\n\nUpon installation, the postinstall script XOR-decodes (using key stf2026) a hardcoded GitHub URL and downloads a Windows binary to %TEMP%\\main.exe, then spawns it detached. On WSL/Linux hosts, an XOR-decoded bridge command is executed to reach the underlying Windows host and run the same payload from inside Linux.\n\nThe postinstall script also sends a POST request containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote, serving as an install beacon and victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime to hide the fetch URL and execution commands.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- chalk-es
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall chalk-es from all systems
- Audit npm install logs to identify affected hosts and installation timestamps
- Scan affected Windows systems for the presence of main.exe in %TEMP% and any suspicious process execution
- Block outbound connections to 193.70.34.101:20099
- Review and revoke any credentials or sensitive data that may have been exposed on affected systems
- Use the legitimate chalk package instead of chalk-es
- Implement npm package name verification and typosquat detection in dependency management workflows
Sources
- GitHub Advisory GHSA-cmm7-8284-wpcq · GitHub Advisory Database
Cite this entry
"Malicious code in chalk-es (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-chalk-es-npm-r0szf0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package