Malicious code in chalk-utils (npm)
The npm package chalk-utils contained malicious code in its postinstall.js script that steals credentials, cryptocurrency wallet data, and sensitive files from developer machines. The package masquerades as a chalk utility while executing a credential and cryptocurrency stealer on installation.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed chalk-utils from npm
- Ecosystems
- Attack vectors
- Affected entities
- chalk-utilsMalicious npm package masquerading as chalk ecosystem utility
The npm package chalk-utils was published with malicious postinstall.js code that executes during npm install. The package masquerades as belonging to the chalk ecosystem while containing a credential and cryptocurrency stealer.
The malicious script harvests sensitive data including npm authentication tokens from ~/.npmrc, git credentials from ~/.git-credentials, and environment variables matching patterns for tokens, secrets, passwords, API keys, AWS, GCP, and Stripe credentials from ~/.env. It also targets cryptocurrency wallets by iterating 71 hardcoded browser extension IDs (MetaMask, Phantom, Coinbase Wallet, Exodus, Trust, Binance, OKX, Ledger Live, Trezor, and others) across Chrome, Brave, Edge, Chromium, Vivaldi, and Opera profiles, reading Local Extension Settings LevelDB files for vault, seed, privateKey, mnemonic, password, and encrypted data.
Additionally, the script scans ~/Documents, ~/Desktop, and ~/Downloads for files matching crypto-related keywords (seed, backup, wallet, phrase, metamask, phantom, vault, key, private), scores file contents against BIP-39 word lists, and harvests files with 8 or more BIP-39 matches along with a 100-character content preview. All harvested data, including hostname and username, is exfiltrated in cleartext to http://149.28.127.35:8888, with support for endpoint rotation via C2_URL environment variable.
The incident was identified through Amazon Inspector and reported via GitHub Security Advisory GHSA-qfhf-894c-75p7.
Indicators of compromise
- Packages
- chalk-utils
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall chalk-utils from all systems: npm uninstall chalk-utils
- Rotate all npm authentication tokens (_authToken and npm_* tokens) in ~/.npmrc
- Rotate all git credentials stored in ~/.git-credentials
- Rotate all API keys, AWS credentials, GCP credentials, Stripe keys, and other secrets that may have been exposed
- Change passwords for cryptocurrency wallets and browser extensions, particularly MetaMask, Phantom, Coinbase Wallet, Exodus, Trust, Binance, OKX, Ledger Live, Trezor, and others
- Review browser extension Local Extension Settings for unauthorized access or modifications
- Audit ~/Documents, ~/Desktop, and ~/Downloads for any suspicious file access or modifications
- Monitor for unauthorized access to accounts using exposed credentials
- Block IP 149.28.127.35 at network perimeter
- Review npm package.json and lock files to ensure chalk-utils is not listed as a dependency
- Use npm audit to identify any remaining malicious packages
Sources
- GitHub Advisory GHSA-qfhf-894c-75p7 · GitHub Advisory Database
Cite this entry
"Malicious code in chalk-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-chalk-utils-npm-1fcwok
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting