Malicious code in chalk-lib (npm)

chalk-lib is a typosquatting npm package mimicking the popular chalk package but contains no legitimate code exports. Its postinstall lifecycle script XOR-decodes a hardcoded URL to download a Windows executable to the temporary directory and executes it silently. When installed in WSL or Linux environments with Windows hosts, it uses a PowerShell bridge to run the same binary on the Windows host, crossing the WSL boundary. The script also exfiltrates platform data to a hardcoded IP address over unencrypted HTTP. The URLs and commands are obfuscated as integer arrays decoded via XOR to evade detection.

Installation of chalk-lib version 1.0.0 results in execution of a potentially malicious Windows executable, which could lead to arbitrary code execution on the Windows host. The cross-environment execution from WSL/Linux to Windows increases the attack surface. The exfiltration of platform information to an attacker-controlled server indicates potential reconnaissance or further targeted attacks. This supply chain compromise can lead to system compromise and data leakage.

Users should avoid installing the chalk-lib package, as it is a malicious typosquat of the legitimate chalk package. Remove any installations of chalk-lib version 1.0.0 from systems. Since no official patch or fix exists, rely on package name verification and use only trusted packages from official sources. Employ dependency scanning tools to detect and block typosquatting or malicious packages. Monitor for any signs of the downloaded executable or network connections to the indicated IP address and remove any artifacts found.