Malicious code in chalk-core (npm)

[email protected] is a malicious npm package that impersonates the popular chalk package but exports no functionality. Its postinstall.js script runs automatically on npm install and XOR-decodes a hidden URL to download an executable payload to the Windows temporary directory, which it then launches detached without any signature or hash verification. On WSL, it detects virtualization and executes a bridge command to fetch and run the same payload on the Windows host. Additionally, it sends platform information to a remote server at IP 193.70.34.101 on port 20099, acting as an install tracker or kill-switch beacon. The package uses multiple XOR-encoded constants to obfuscate URLs and commands, complicating casual inspection.

The malicious package can execute arbitrary code on the victim's machine without user consent or verification, potentially leading to system compromise. It can run unsigned executables, evade detection by running detached and hidden, and communicate with a remote server to report installation and possibly receive commands. The WSL-specific behavior extends the attack surface to Linux environments running on Windows. This can lead to unauthorized access, data theft, or further malware deployment.

Users should avoid installing [email protected] and verify package names carefully to prevent typosquatting attacks. Since no official patch or fix is available, removal of this package and scanning for the downloaded payload (%TEMP%\main.exe) is recommended. Use trusted sources and package registries, and consider employing tools that detect typosquatting or malicious packages. Monitor for suspicious postinstall scripts in npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.