Malicious code in chalk-util (npm)
chalk-util@1.0.0 is a typosquat package on npm containing malicious postinstall code that downloads and executes a binary on Windows and Linux systems. The package XOR-decodes obfuscated URLs and IP addresses to fetch and run attacker-controlled executables, and beacons installation events to a command-and-control server.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed chalk-util@1.0.0 from npm
- Ecosystems
- Attack vectors
- Affected entities
- chalk-util · 1.0.0
chalk-util@1.0.0 is a typosquatting attack targeting the popular chalk npm package. The malicious package exports an empty object as its main functionality, with all malicious code hidden in scripts/postinstall.js.
Upon installation, the postinstall script XOR-decodes obfuscated data using the key 'stf2026' to reconstruct a GitHub asset URL and an IP address (193.70.34.101). On Windows systems, it downloads a binary to %TEMP%\main.exe and executes it with a hidden window. On Linux systems detected via /proc/version (including WSL), it uses a decoded PowerShell bridge command to achieve execution.
The package also sends an installation beacon to http://193.70.34.101:20099/vote over plain HTTP, posting a JSON body with the resolved platform label. Multiple byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime to hide the fetch URL and shell commands from static analysis.
The attack leverages npm's postinstall lifecycle hook to achieve automatic execution on default installation, with no user interaction required. The fetched binary contents are entirely attacker-controlled and unverified.
Indicators of compromise
- Packages
- chalk-util
- IPs
- 193.70.34.101
Remediation
- Immediately uninstall chalk-util from all systems and projects
- Audit npm install logs and package-lock.json files to identify if chalk-util@1.0.0 was ever installed
- Assume any system that installed chalk-util@1.0.0 is compromised; perform forensic analysis and consider full system rebuild
- Check for suspicious processes, network connections to 193.70.34.101:20099, and unexpected binaries in %TEMP% directories
- Use npm audit to scan for the malicious package and update dependency specifications to explicitly exclude it
- Consider using npm package lock files and integrity verification to prevent installation of unexpected packages
- Monitor for indicators of compromise from the C2 server at 193.70.34.101
Sources
- GitHub Advisory GHSA-8rc4-5j6v-qqxc · GitHub Advisory Database
Cite this entry
"Malicious code in chalk-util (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-chalk-util-npm-4t9vmw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package