chalk-plus-js@7.0.4

Analysis

This is a combosquat of the popular chalk package whose postinstall lifecycle hook runs "node lib/utils/index.js". That script spawns a detached child process using process.execPath (node) to execute a bundled script file, with the child detached so it outlives the install and continues running in the background for stealth/persistence after npm exits. The detached-subprocess-from-postinstall pattern and the chalk combosquat name are consistent with a credential/secret-stealing dropper. The specific outbound exfiltration endpoint could not be recovered from the sample, so no network IOC is provided.