MAL-2026-14166

    Dashboard / Malicious Package / MAL-2026-14166

    MAL-2026-14166

    Published: 18 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in chalk-es (npm)

    Details: Source: amazon-inspector (9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc) Package name mimics `chalk` but ships an empty library body; the only real behavior lives in `scripts/postinstall.js`. On install the script XOR-decodes (key `stf2026`) a hardcoded GitHub URL and downloads a Windows binary to `%TEMP%\main.exe`, then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux. The postinstall also POSTs a JSON body containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at `http://193.70.34.101:20099/vote`, serving as an install beacon/victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime specifically to hide the fetch URL and the Windows/WSL execution command.

    References: https://www.npmjs.com/package/chalk-es/v/1.0.0

    Affected packages

    Package

    Name: chalk-es

    Purl: pkg:npm/chalk-es

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0