Malicious code in chalk-lib (npm)
chalk-lib is a typosquatting attack on the popular chalk npm package that executes malicious code via postinstall scripts. The malware downloads and executes a Windows binary and can bridge attacks across WSL boundaries to compromise the Windows host.
- Disclosed
- Last updated
- Blast radius
- npm ecosystem; Windows and WSL/Linux systems with npm installed
- Ecosystems
- Attack vectors
- Affected entities
- chalk-libtyposquat of popular chalk package
chalk-lib is a malicious npm package that typosquats the legitimate chalk library. The package contains an empty library body (index.js exports {}) with all malicious functionality implemented in the postinstall lifecycle script.
Upon installation, scripts/postinstall.js XOR-decodes a hardcoded URL (key 'stf2026') pointing to github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads the executable to %TEMP%/main.exe on Windows systems, and executes it with detached stdio and hidden window.
The attack extends to WSL environments: when the postinstall script detects WSL or Linux with a reachable Windows host (via WSL_DISTRO_NAME, /proc/version, or /proc/sys/kernel/osrelease containing 'microsoft'), it XOR-decodes a PowerShell bridge command and executes it to fetch and run the same binary on the Windows host, bridging the attack across the WSL boundary.
In parallel, the postinstall script POSTs a JSON body containing the installer's platform label to 193.70.34.101:20099/vote over plain HTTP. URLs, PowerShell commands, and bridge scripts are stored as integer arrays and reconstructed via XOR decoding to evade static string matching.
Indicators of compromise
- Packages
- chalk-lib
- Domains
- github.com/bebraz1/qPzM50V1AKG0rVlH
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall chalk-lib from all systems
- Audit npm install logs to identify affected systems and installation timestamps
- Scan Windows systems for %TEMP%/main.exe and any spawned processes from the postinstall script
- Review network logs for connections to 193.70.34.101:20099
- Verify that the legitimate chalk package (not chalk-lib) is installed for any required functionality
- Implement npm package name verification and typosquatting detection in dependency management
- Use npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-5jqx-4wqg-wr6q · GitHub Advisory Database
Cite this entry
"Malicious code in chalk-lib (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-chalk-lib-npm-1fjhts
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package