MAL-2026-4517 Malicious code in chalk-tempalte (npm)

Package name chalk-tempalte is a single-character transposition of the popular chalk-template package (a top-tier npm utility), consistent with deliberate typosquatting. The tarball ships a postinstall.js lifecycle script that imports child_process, performs HTTP GET/POST traffic via http.request(...), and collects host identifiers (hostname: fields appear repeatedly throughout the script at lines 20, 46, 287, 409, 427). A second large file, phantom.js, contains multiple POST sinks (lines 1807, 2113, 3183, 6795, 6852). The structural shape — typosquat name + postinstall script that combines child_process, outbound HTTP, and host/system metadata harvesting — matches the credential/host-data exfiltration pattern used by recent npm supply-chain campaigns. Installing this package causes the postinstall hook to fire automatically on npm install, transmitting installer machine data to a remote endpoint and providing a foothold for further code execution.