registry / Remote code execution / chalk-plus-ts
chalk-plus-ts
Copyright (c) React Training 2015-present
This report shows the evidence for chalk-plus-ts@1.0.4. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection confirms an install-time detached remote-code loader with obfuscation and dynamic Function execution. This is concrete malicious behavior, not package-aligned Nodemailer network functionality.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install postinstall
Impact
arbitrary code execution during installation with installer privileges
Mechanism
detached remote code execution loader
Attack narrative
On installation, package.json launches lib/utils/index.js. That script spawns a detached Node process for lib/utils/smtp-connection/index.js and exits. The child contains obfuscated code that fetches JSON from api.jsonbin.io, reads record.cookie, constructs it as a Function with require access, and executes it. This gives the remote endpoint control of install-time code execution.
AI rationale
Direct source inspection confirms an install-time detached remote-code loader with obfuscation and dynamic Function execution. This is concrete malicious behavior, not package-aligned Nodemailer network functionality.
Evidence
package.jsonlib/utils/index.jslib/utils/smtp-connection/index.jslib/utils/smtp-connection/LICENSElib/nodemailer.js
Network endpoints3
api.jsonbin.io/v3/b/6a461991f5f4af5e295272d4api.nodemailer.comethereal.email
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines postinstall: node lib/utils/index.js
- lib/utils/index.js spawns detached child process running lib/utils/smtp-connection/index.js
- lib/utils/smtp-connection/index.js is obfuscated and fetches https://api.jsonbin.io/v3/b/6a461991f5f4af5e295272d4
- Fetched JSON field record.cookie is executed with new Function(...)(require)
- lib/utils/smtp-connection/LICENSE is a 262624-byte hex/encrypted-looking blob colocated with the loader
Evidence against
- lib/nodemailer.js resembles bundled Nodemailer mailer functionality
- api.nodemailer.com and ethereal.email calls are user-invoked test-account functionality, not install-time
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/utils/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/utils/index.jsView file
2L3: const { spawn } = require('child_process');
L4:
High
2Cross-file remote execution chain: lib/utils/index.js spawns lib/utils/smtp-connection/index.js; helper contains network access plus dynamic code execution.
L2:
L3: const { spawn } = require('child_process');
L4:
...
L7:
L8: const filePath = path.join(__dirname, 'smtp-connection/index.js');
L9:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
lib/utils/index.jsFindings
5 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/utils/index.js
HighObfuscated Payload Loaderlib/utils/smtp-connection/index.js
HighCross File Remote Execution Contextlib/utils/index.js
HighObfuscated
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvallib/utils/smtp-connection/index.js
LowWeak Cryptolib/smtp-connection/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to chalk-plus-ts@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing chalk-plus-ts@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.