MAL-2026-14165 Malicious code in chalk-core (npm)

[email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in scripts/postinstall.js, which runs automatically on npm install. The script XOR-decodes (key 'stf2026') a hidden URL that resolves to a github.com download, fetches an executable to %TEMP%\main.exe on Windows, and launches it detached (spawn with detached:true, stdio:'ignore', windowsHide:true) with no hash or signature verification. When running under WSL, isVirtualizedLinux() inspects /proc/version, /proc/sys/kernel/osrelease, and WSL_DISTRO_NAME / WSLENV, then exec()s a XOR-decoded bridge command that reaches out of the Linux guest to the Windows host to fetch and execute the same payload. Before the drop, postinstall assembles the bare IPv4 193.70.34.101 from a string-array literal ['193','70','34','101'].join('.') and POSTs the host platform to http://193.70.34.101:20099/vote — an install-tracker/kill-switch beacon on a non-standard port. Four separate XOR-encoded byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) hide the download URL and shell commands from casual inspection.