# MAL-2026-14168: Malicious code in chalk-util (npm)


- **Type:** Malicious package
- **Package:** `chalk-util` (npm)
- **Published:** 18 Aug 2026

## What is MAL-2026-14168?

MAL-2026-14168 is a malicious package in chalk-util, published on 18 Aug 2026. 

### Official description

chalk-util@1.0.0 is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm install, postinstall XOR-decodes an obfuscated URL (key 'stf2026') pointing to an https://github.com/... asset, downloads it to %TEMP%\main.exe on Windows (and via a decoded PowerShell bridge command on WSL-detected Linux, identified through /proc/version), and spawns it detached with a hidden window. The same postinstall reconstructs the bare IP 193.70.34.101 via ['193','70','34','101'].join('.') and POSTs a JSON body containing the resolved platform label to http://193.70.34.101:20099/vote over plain HTTP as an install beacon. Four separate byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime to hide the fetch URL and the shell command passed to exec(). The auto-execute-on-default-install gate is satisfied via the postinstall lifecycle hook; the fetched binary contents are attacker-controlled and unverified.

## What should I do about MAL-2026-14168?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14168 is a malicious package: chalk-util (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14168/ (Markdown: https://insights.sbomify.com/MAL-2026-14168/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14168

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14168/
Summaries are generated and may contain mistakes; the official description above is the record.