Malicious code in chalk-es (npm)

The 'chalk-es' npm package version 1.0.0 contains malicious code embedded in its post-install script. This script XOR-decodes a hardcoded GitHub URL to download a Windows binary to the %TEMP% directory and executes it detached. On WSL/Linux systems, it uses an XOR-decoded bridge command to execute the payload on the Windows host. Additionally, the script sends a JSON beacon containing platform details to a hardcoded IP address (http://193.70.34.101:20099/vote), serving as an install beacon or victim tracker. The use of XOR encoding for URLs and commands is intended to evade detection. This package does not provide any legitimate functionality and is designed for malicious purposes.

Installation of this package results in the execution of a potentially malicious Windows binary on the victim's machine, which could lead to unauthorized code execution and compromise. The beaconing behavior also allows the attacker to track installations and potentially identify infected hosts. The threat affects Windows systems directly and Windows hosts running WSL/Linux environments. No specific exploit in the wild is currently known, but the presence of a downloader and execution of arbitrary code poses a high risk of system compromise.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The primary mitigation is to avoid installing the 'chalk-es' package version 1.0.0. Users should verify package authenticity and source before installation, prefer official packages (such as 'chalk'), and remove any installations of 'chalk-es' 1.0.0 if found. Monitoring for unexpected post-install scripts in npm packages and restricting execution of downloaded binaries can also help mitigate risk.