Malicious code in chalk-pack (npm)
A malicious npm package named chalk-pack impersonated the legitimate chalk library and executed a two-stage stealer on install: harvesting npm credentials, environment variables, and cryptocurrency wallet data from browser extensions and local files, exfiltrating to a hardcoded C2 server.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed chalk-pack from npm
- Ecosystems
- Attack vectors
- Affected entities
- chalk-packMalicious package impersonating chalk
The npm package chalk-pack was a typosquatting attack impersonating the legitimate chalk library. The package contained a stub index.js that mimicked lodash, with the actual malicious payload in postinstall.js.
Upon installation, the postinstall script executed a two-part stealer. The first component harvested credentials by reading ~/.npmrc, ~/.env, and ~/.git-credentials to extract npm auth tokens and environment variables containing API keys, database URLs, and cloud credentials. The second component targeted cryptocurrency wallets by iterating through 71 hardcoded browser extension IDs (MetaMask, Phantom, Coinbase, Trust, Binance, OKX, Ledger, Trezor, Rabby, Keplr, Solflare, BitKeep, and others), reading extension settings and log files for wallet data, and scanning local directories (~/Documents, ~/Desktop, ~/Downloads) for files matching BIP39 word counts.
All collected data was exfiltrated via plaintext HTTP POST to http://149.28.127.35:8888, with the C2 URL hardcoded in the postinstall script. The malware was designed to run silently with all errors suppressed via try-catch blocks. The incident was detected and reported via Amazon Inspector.
Indicators of compromise
- Packages
- chalk-pack
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall chalk-pack from all systems and projects
- Rotate all npm authentication tokens and API keys that may have been exposed
- Review git credentials and environment variables for unauthorized access
- Audit browser extension wallets and cryptocurrency accounts for unauthorized transactions
- Use the legitimate chalk package instead of chalk-pack
- Implement package name verification and allowlisting in dependency management
- Monitor npm audit logs and CI/CD systems for suspicious package installations
- Consider using npm package signature verification and private registries to prevent typosquatting attacks
Sources
- GitHub Advisory GHSA-v7hx-pp9r-7rvr · GitHub Advisory Database
Cite this entry
"Malicious code in chalk-pack (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-chalk-pack-npm-1dmzgg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting