OpenSSF/OSV advisory MAL-2026-4517 confirms this npm version as malicious. Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm utility), consistent with deliberate typosquatting. The tarball ships a `postinstall.js` lifecycle script that imports `child_process`, performs HTTP GET/POST traffic via `http.request(...)`, and collects host identifiers (`hostname:` fields appear repeatedly throughout the script at lines 20,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chalk-tempalte (npm)
Details
Package name `chalk-tempalte` is a single-character transposition of the popular `chalk-template` package (a top-tier npm utility), consistent with deliberate typosquatting. The tarball ships a `postinstall.js` lifecycle script that imports `child_process`, performs HTTP GET/POST traffic via `http.request(...)`, and collects host identifiers (`hostname:` fields appear repeatedly throughout the script at lines 20, 46, 287, 409, 427). A second large file, `phantom.js`, contains multiple POST sinks (lines 1807, 2113, 3183, 6795, 6852). The structural shape — typosquat name + postinstall script that combines child_process, outbound HTTP, and host/system metadata harvesting — matches the credential/host-data exfiltration pattern used by recent npm supply-chain campaigns. Installing this package causes the postinstall hook to fire automatically on `npm install`, transmitting installer machine data to a remote endpoint and providing a foothold for further code execution.
Decision reason
OpenSSF Malicious Packages via OSV confirms chalk-tempalte@1.0.20 as malicious (MAL-2026-4517): Malicious code in chalk-tempalte (npm)