[email protected] is a typosquatting package mimicking the legitimate chalk package. Its index.js exports an empty object, but its postinstall.js script executes automatically upon installation. This script XOR-decodes an obfuscated URL pointing to a GitHub asset, downloads the binary to %TEMP%\main.exe on Windows or executes it via a PowerShell bridge on Linux (detected via /proc/version), and runs it detached with a hidden window. Additionally, it reconstructs and contacts the IP 193.70.34.101 over HTTP, sending a JSON payload with platform details as an install beacon. The fetched binary is attacker-controlled and unverified, posing a risk of arbitrary code execution. Multiple byte-array constants are XOR-decoded at runtime to conceal URLs and shell commands.

Installation of [email protected] results in automatic execution of attacker-controlled code, potentially leading to arbitrary code execution on the affected system. The package also leaks platform information to a remote server via an unencrypted HTTP POST request. The malicious binary is downloaded and executed without verification, increasing risk of compromise. There is no indication of active exploitation in the wild at this time.

Avoid installing the chalk-util package, as it is a malicious typosquat. Remove any installations of [email protected] from your environment. Use the legitimate chalk package instead. Since no official patch or fix exists for chalk-util (it is a malicious package, not a legitimate product), remediation involves removing the package and scanning affected systems for the downloaded binary and any persistence mechanisms. Monitor for network connections to 193.70.34.101 and block if possible. Patch status is not applicable; this is a malicious package rather than a vulnerability in legitimate software.