OpenSSF/OSV advisory MAL-2026-14166 confirms this npm version as malicious. Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On install the script XOR-decodes (key `stf2026`) a hardcoded GitHub URL and downloads a Windows binary to `%TEMP%\main.exe`, then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chalk-es (npm)
Details
Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On install the script XOR-decodes (key `stf2026`) a hardcoded GitHub URL and downloads a Windows binary to `%TEMP%\main.exe`, then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux. The postinstall also POSTs a JSON body containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at `http://193.70.34.101:20099/vote`, serving as an install beacon/victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime specifically to hide the fetch URL and the Windows/WSL execution command.
Decision reason
OpenSSF Malicious Packages via OSV confirms chalk-es@1.0.0 as malicious (MAL-2026-14166): Malicious code in chalk-es (npm)