VulnerabilityPublished 20 May 2026Updated 1 Sep 2026

chalk-tempalte (npm) · Malicious Code

Affects chalk-tempalteSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 8 Sep 2026, 09:23 UTC

What to do

Affected software

Product	Affected	Fixed in
npmchalk-tempalte	Affected =1.0.15 =1.0.16 =1.0.14 =1.0.17 =1.0.19 =1.0.20	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Avoid installing the 'chalk-tempalte' package. Verify package names carefully to prevent typosquatting attacks. Use trusted sources and package integrity verification to prevent supply-chain attacks.

Description

The npm package 'chalk-tempalte' is a malicious typosquatting package mimicking the popular 'chalk-template' utility. It contains a postinstall script that executes automatically upon installation, which collects host identifiers and sends them via HTTP requests to a remote endpoint. The package also includes a large script with multiple data exfiltration points. This behavior aligns with known npm supply-chain attacks aimed at credential and host data theft. Installing this package risks unauthorized data exfiltration and potential further code execution on the host system.

Impact

Installing 'chalk-tempalte' results in automatic execution of a postinstall script that collects system metadata and transmits it to a remote server, potentially exposing sensitive host information. This exfiltration can lead to unauthorized disclosure of environment details and may enable subsequent malicious actions on the compromised system. The package thus poses a significant risk of data leakage and system compromise.

Summary

The 'chalk-tempalte' npm package is a deliberate typosquat of the legitimate 'chalk-template' package. Its tarball includes a postinstall.js lifecycle script that imports 'child_process', performs outbound HTTP GET and POST requests, and harvests host identifiers such as hostnames. Additionally, it contains a large 'phantom.js' file with multiple POST sinks, indicating extensive data exfiltration capabilities. The combination of typosquatting, automatic postinstall execution, system metadata harvesting, and outbound network communication matches patterns observed in recent npm supply-chain attacks designed to steal credentials and host data. This package provides a foothold for further malicious code execution after installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 09:23 UTC

Technical details

References

Community reviews