MAL-2026-10584

    Dashboard / Malicious Package / MAL-2026-10584

    MAL-2026-10584

    Published: 14 Jul 2026Last Modified: 14 Jul 2026

    Summary: Malicious code in chalkdevx (npm)

    Details: Source: amazon-inspector (3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad) package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates ~65 credential and CI environment variables (NPM_TOKEN, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, STRIPE_*, DOCKER_*, cloud provider tokens, private keys), reads home-directory credential files including ~/.npmrc, ~/.env*, config.json, and credentials.json, and scans ~/.config for files matching token/cred/secret patterns. Collected data — together with host identifiers (os.hostname(), os.platform(), cwd, pid) — is POSTed as JSON to a hardcoded https://webhook.cool/at/tender-deer-80/... endpoint, a public webhook-inspection service unrelated to any declared package purpose. The package's declared functionality is trivial (empty description, minimal index.js); the credential-harvesting postinstall is the package's actual behavior. The name resembles the popular `chalk` package.

    References: https://www.npmjs.com/package/chalkdevx/v/2.0.0

    Affected packages

    Package

    Name: chalkdevx

    Purl: pkg:npm/chalkdevx

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.0
    MAL-2026-10584 | CVE-DB