The npm package 'chalk-tempalte' is a malicious typosquatting package mimicking the popular 'chalk-template' utility. It contains a postinstall script that executes automatically upon installation, which collects host identifiers and sends them via HTTP requests to a remote endpoint. The package also includes a large script with multiple data exfiltration points. This behavior aligns with known npm supply-chain attacks aimed at credential and host data theft. Installing this package risks unauthorized data exfiltration and potential further code execution on the host system.