Malicious code in chalk-plus-ts (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08276c56353501373a202d28f6af6ee2a7c0b20d28a07d99c4c16309df46269c) package.json declares postinstall=`node lib/utils/index.js`, which spawns a detached child process running lib/utils/smtp-connection/index.js. That script fetches https://www.jsonkeeper.com/b/QHDXR (a mutable, anonymous JSON paste host) and passes the response's `cookie` field directly into `new Function('require', data.cookie)(require)`, executing attacker-controlled JavaScript with full Node privileges on every installer machine. The detached child with ignored stdio is designed to suppress visibility of the activity. The package additionally ships lib/utils/smtp-connection/parse.js, which exposes an AES-256-CBC decryption helper with a hardcoded key and IV — consistent with a staged loader for decoding subsequent payloads delivered through the same channel. Identity is laundered: the package name `chalk-plus-ts` impersonates the popular `chalk` package, the main entry is a verbatim copy of nodemailer.js, the author field is set to nodemailer's real maintainer (Andris Reinman), and the description field is unrelated React Training boilerplate — all to lure installs from multiple ecosystems. ## Source: ghsa-malware (ed0c6ed9fc3ef01e8590b5cb3967a1304333179ff797d779d9a600e64a48ffde) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The chalk-plus-ts npm package (version 1.0.3) is a malicious package masquerading as the popular chalk package. Its postinstall script runs a detached child process that downloads attacker-controlled JavaScript from a mutable JSON paste site and executes it with full Node.js privileges on the installing machine. The package also contains an AES-256-CBC decryption helper with hardcoded keys, indicating a staged payload loader. The package author and description fields are falsified to impersonate legitimate software and lure installs. This results in full compromise of any machine where the package is installed.
Potential Impact
Installation of chalk-plus-ts version 1.0.3 leads to execution of arbitrary attacker-controlled code with full Node.js privileges, resulting in complete compromise of the affected system. All secrets and keys stored on the compromised machine are at risk and should be considered exposed. Removing the package does not guarantee removal of all malicious artifacts due to the elevated privileges granted during installation.
Mitigation Recommendations
No official patch or fix is available. The package should be immediately removed from all systems. All secrets and credentials stored on affected machines must be rotated from a secure, uncompromised environment. Due to the full system compromise risk, affected machines should be thoroughly audited and potentially rebuilt. Avoid installing packages with suspicious or impersonating metadata. Monitor package sources carefully to prevent similar supply chain attacks.
Malicious code in chalk-plus-ts (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08276c56353501373a202d28f6af6ee2a7c0b20d28a07d99c4c16309df46269c) package.json declares postinstall=`node lib/utils/index.js`, which spawns a detached child process running lib/utils/smtp-connection/index.js. That script fetches https://www.jsonkeeper.com/b/QHDXR (a mutable, anonymous JSON paste host) and passes the response's `cookie` field directly into `new Function('require', data.cookie)(require)`, executing attacker-controlled JavaScript with full Node privileges on every installer machine. The detached child with ignored stdio is designed to suppress visibility of the activity. The package additionally ships lib/utils/smtp-connection/parse.js, which exposes an AES-256-CBC decryption helper with a hardcoded key and IV — consistent with a staged loader for decoding subsequent payloads delivered through the same channel. Identity is laundered: the package name `chalk-plus-ts` impersonates the popular `chalk` package, the main entry is a verbatim copy of nodemailer.js, the author field is set to nodemailer's real maintainer (Andris Reinman), and the description field is unrelated React Training boilerplate — all to lure installs from multiple ecosystems. ## Source: ghsa-malware (ed0c6ed9fc3ef01e8590b5cb3967a1304333179ff797d779d9a600e64a48ffde) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The chalk-plus-ts npm package (version 1.0.3) is a malicious package masquerading as the popular chalk package. Its postinstall script runs a detached child process that downloads attacker-controlled JavaScript from a mutable JSON paste site and executes it with full Node.js privileges on the installing machine. The package also contains an AES-256-CBC decryption helper with hardcoded keys, indicating a staged payload loader. The package author and description fields are falsified to impersonate legitimate software and lure installs. This results in full compromise of any machine where the package is installed.
Potential Impact
Installation of chalk-plus-ts version 1.0.3 leads to execution of arbitrary attacker-controlled code with full Node.js privileges, resulting in complete compromise of the affected system. All secrets and keys stored on the compromised machine are at risk and should be considered exposed. Removing the package does not guarantee removal of all malicious artifacts due to the elevated privileges granted during installation.
Mitigation Recommendations
No official patch or fix is available. The package should be immediately removed from all systems. All secrets and credentials stored on affected machines must be rotated from a secure, uncompromised environment. Due to the full system compromise risk, affected machines should be thoroughly audited and potentially rebuilt. Avoid installing packages with suspicious or impersonating metadata. Monitor package sources carefully to prevent similar supply chain attacks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5710
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-247v-x9qw-cc59"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4c345127e9c797195fcf73
Added to database: 07/06/2026, 23:03:45 UTC
Last enriched: 07/06/2026, 23:37:52 UTC
Last updated: 07/19/2026, 23:13:43 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.