chalk-utils
This report shows the evidence for chalk-utils@2.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3755 confirms this npm version as malicious.
Advisory
MAL-2026-3755
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in chalk-utils (npm)
Details
On `npm install`, postinstall.js runs a credential and cryptocurrency stealer against the installer's machine. It reads ~/.npmrc (extracting _authToken and npm_* tokens), ~/.git-credentials, and ~/.env (extracting values keyed by token/secret/password/api/aws/gcp/stripe patterns), then iterates a hardcoded list of 71 browser extension IDs for major crypto wallets (MetaMask, Phantom, Coinbase Wallet, Exodus, Trust, Binance, OKX, Ledger Live, Trezor, and others) across Chrome/Brave/Edge/Chromium/Vivaldi/Opera profiles, reading each extension's Local Extension Settings LevelDB `.log` files and applying regexes for `vault`, `seed`, `privateKey`, `mnemonic`, `password`, and `encrypted`. It additionally walks ~/Documents, ~/Desktop, and ~/Downloads for filenames matching crypto keywords (seed, backup, wallet, phrase, metamask, phantom, vault, key, private), scores file contents against a BIP-39 word list, and harvests any file with >=8 BIP-39 matches along with a 100-character content preview. Harvested data (plus os.hostname() and os.userInfo().username) is POSTed in cleartext to http://149.28.127.35:8888, a bare-IP C2 endpoint overridable via a `C2_URL` environment variable to support endpoint rotation. The package name `chalk-utils` masquerades as belonging to the `chalk` ecosystem while index.js is a dummy stub whose comment reads `lodash-js — Just a dummy module. The real payload is in postinstall.js`, and postinstall.js self-describes as `Token harvester + Crypto wallet scanner. Runs on npm install. Silent. Zero trace.`
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to chalk-utils@2.0.0.
The same advisory and Firewall decision cover 3 recorded versions
1.0.3, 1.0.4, 2.0.0
The versions list below shows the verdict for each recorded version.
- Avoid installing chalk-utils@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.