chalk-es@1.0.0

Analysis

chalk-es@1.0.0 (a combosquat of the chalk package) runs a malicious postinstall hook (scripts/postinstall.js) on install. The hook fingerprints the host (platform, WSL detection), POSTs a platform beacon to C2 193[.]70[.]34[.]101:20099 at path /vote, then on Windows/WSL systems downloads a native binary from hxxps://github[.]com/bezbz1/qzM50VKAG0rVlH/releases/download/main[.]exe to %TEMP%\main.exe and executes it as a detached process. On WSL it instead runs an XOR-decoded bridge-launcher command via exec. Payload URLs and C2 addresses are XOR-obfuscated in the script.