MalwarePublished 3 Feb 2025Updated 1 Sep 2026

chakll (npm) · Malicious Code

Affects chakllSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmchakll	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'chakll' version 1.0.0 is identified as malicious due to its communication with a domain linked to malicious activity. Installation or execution of this package may lead to full compromise of the affected system. Immediate removal of the package is advised, and all secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. However, removal of the package may not fully eliminate the malicious presence due to potential deeper system compromise.

Impact

Systems with the 'chakll' package version 1.0.0 installed or running are considered fully compromised, potentially allowing attackers full control over the system. This compromises all stored secrets and keys, necessitating immediate rotation from a secure environment. The malicious activity includes communication with a domain linked to malicious operations, indicating active data exfiltration or command and control. The compromise severity is high due to the total system control risk.

Defensive guidance

Remove the 'chakll' package version 1.0.0 immediately from affected systems. Rotate all secrets and keys stored on the compromised system from a separate, trusted machine. Due to the potential for full system compromise, consider rebuilding the affected system from a known good backup or reinstalling the operating system to ensure complete removal of malicious components. Monitor for any suspicious activity and avoid reinstalling the package.

Summary

The 'chakll' npm package version 1.0.0 contains malicious code that communicates with a domain associated with malicious activity. According to the source advisory (GHSA-x86w-fpjg-whp5), any system with this package installed or running should be considered fully compromised. This implies that the package may have granted an attacker full control over the system. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer. Due to the nature of the compromise, simply removing the package may not guarantee complete eradication of the malicious software introduced.

References

github.com/advisories/GHSA-x86w-fpjg-whp5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 09:23 UTC

Technical details

References

Community reviews