The 'chalk-tempalte' npm package is a deliberate typosquat of the legitimate 'chalk-template' package. Its tarball includes a postinstall.js lifecycle script that imports 'child_process', performs outbound HTTP GET and POST requests, and harvests host identifiers such as hostnames. Additionally, it contains a large 'phantom.js' file with multiple POST sinks, indicating extensive data exfiltration capabilities. The combination of typosquatting, automatic postinstall execution, system metadata harvesting, and outbound network communication matches patterns observed in recent npm supply-chain attacks designed to steal credentials and host data. This package provides a foothold for further malicious code execution after installation.

Installing 'chalk-tempalte' results in automatic execution of a postinstall script that collects system metadata and transmits it to a remote server, potentially exposing sensitive host information. This exfiltration can lead to unauthorized disclosure of environment details and may enable subsequent malicious actions on the compromised system. The package thus poses a significant risk of data leakage and system compromise.

Avoid installing the 'chalk-tempalte' package. Verify package names carefully to prevent typosquatting attacks. Since no official patch or remediation is available, users should remove any installations of this package immediately and audit systems for signs of compromise. Use trusted sources and package integrity verification to prevent supply-chain attacks.