Malicious code in analysis-chart (npm)
The npm package 'analysis-chart' contains a malicious postinstall script that downloads and executes attacker-controlled native code on Windows developer machines. The payload is XOR-decrypted and injected into memory, then executed. After execution, the script attempts to remove evidence by deleting files and removing the package from the host project. The package's API is a decoy, and author metadata appears fabricated.
AI Analysis
Technical Summary
The 'analysis-chart' npm package versions 2.0.8 through 2.0.28 (specific versions enumerated) include a postinstall hook (install-hook.js) which downloads an opaque binary payload from an unrelated third-party GitHub release. This payload is XOR-decrypted with key 0x42 and executed in-memory via Windows API calls (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) resulting in arbitrary native code execution on the developer's machine during 'npm install'. The postinstall script then runs a cleanup script that deletes the package folder, removes 'analysis-chart' from package.json, and self-deletes to hinder forensic analysis. The package's exposed API is unrelated to the malicious behavior and serves as a decoy. The author metadata and repository references appear fabricated, indicating a supply chain compromise or malicious package masquerading as legitimate.
Potential Impact
Any system that installs or runs this package is considered fully compromised. The attacker gains arbitrary native code execution on the developer's machine, potentially allowing full control. Secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.
Mitigation Recommendations
No official patch or remediation is indicated. Immediate removal of the 'analysis-chart' package is recommended. All secrets and credentials stored on affected machines must be rotated from a different, uncompromised system. Due to the nature of the compromise, affected systems should be thoroughly inspected and potentially rebuilt to ensure no persistent malicious code remains.
Malicious code in analysis-chart (npm)
Description
The npm package 'analysis-chart' contains a malicious postinstall script that downloads and executes attacker-controlled native code on Windows developer machines. The payload is XOR-decrypted and injected into memory, then executed. After execution, the script attempts to remove evidence by deleting files and removing the package from the host project. The package's API is a decoy, and author metadata appears fabricated.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'analysis-chart' npm package versions 2.0.8 through 2.0.28 (specific versions enumerated) include a postinstall hook (install-hook.js) which downloads an opaque binary payload from an unrelated third-party GitHub release. This payload is XOR-decrypted with key 0x42 and executed in-memory via Windows API calls (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) resulting in arbitrary native code execution on the developer's machine during 'npm install'. The postinstall script then runs a cleanup script that deletes the package folder, removes 'analysis-chart' from package.json, and self-deletes to hinder forensic analysis. The package's exposed API is unrelated to the malicious behavior and serves as a decoy. The author metadata and repository references appear fabricated, indicating a supply chain compromise or malicious package masquerading as legitimate.
Potential Impact
Any system that installs or runs this package is considered fully compromised. The attacker gains arbitrary native code execution on the developer's machine, potentially allowing full control. Secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.
Mitigation Recommendations
No official patch or remediation is indicated. Immediate removal of the 'analysis-chart' package is recommended. All secrets and credentials stored on affected machines must be rotated from a different, uncompromised system. Due to the nature of the compromise, affected systems should be thoroughly inspected and potentially rebuilt to ensure no persistent malicious code remains.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6299
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-2h56-6c2c-2475"]
- Ecosystems
- ["npm"]
Threat ID: 6a3ef7be27e9c79719ffd4fb
Added to database: 06/26/2026, 22:05:50 UTC
Last enriched: 09/12/2026, 21:47:04 UTC
Last updated: 09/13/2026, 08:04:08 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.