The figlet-chalk-render npm package (version 1.2.1) includes a top-level immediately-invoked function expression (IIFE) that triggers on module import. On Windows systems, it reconstructs standard Node.js module names and the spawn method through obfuscation techniques to conceal its actions. It downloads a payload named RuntimeBroker.exe from a hardcoded plain-HTTP IP address and saves it to the OS temporary directory. The payload is then executed detached and hidden from the user. The code includes environment checks to avoid execution in continuous integration (CI) and sandbox environments, indicating anti-analysis measures. These actions are unrelated to the package's stated purpose and indicate a malicious dropper behavior.

This malicious package can lead to arbitrary code execution on Windows hosts when the package is imported, potentially allowing attackers to run unauthorized payloads disguised as legitimate system processes. The payload is downloaded over unencrypted HTTP, increasing the risk of interception or tampering. The evasion of sandbox and CI environments suggests attempts to avoid detection during automated analysis.

No patch or remediation is currently documented for this package version. Users should immediately avoid using figlet-chalk-render version 1.2.1 and remove it from their environments. It is recommended to audit dependencies for this package and replace it with trusted alternatives. Monitor for updates from the package maintainer or npm advisories for any official fixes.