MAL-2026-14167 Malicious code in chalk-lib (npm)

chalk-lib is a typosquat of the popular chalk package with an empty library body (index.js exports {}) whose entire effect is the postinstall lifecycle script. On npm install, scripts/postinstall.js XOR-decodes (key 'stf2026') a hardcoded URL pointing at github.com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe, downloads the executable to %TEMP%/main.exe on Windows, and spawns it detached with stdio:'ignore' and windowsHide:true. When the environment is WSL or Linux with the Windows host reachable (WSL_DISTRO_NAME / /proc/version / /proc/sys/kernel/osrelease containing 'microsoft'), a second code path XOR-decodes a PowerShell bridge command and script and exec()s it to fetch and run the same binary on the Windows host, extending the attack across the WSL boundary. In parallel, postinstall POSTs a JSON body containing the installer's platform label to a hardcoded bare-IP endpoint at 193.70.34.101:20099/vote over plain HTTP; the IP is assembled by joining the octet array ['193','70','34','101'] to evade static string matching. URLs, the PowerShell command, and the bridge script are all stored as integer arrays and reconstructed via an XOR unpackSegment() routine.