chalk-plus-ts@1.0.3

Analysis

A trojanized nodemailer clone published under a combosquat name ("chalk-plus-ts" riding the chalk+TypeScript popularity). The publisher (andrii0122) impersonates the real nodemailer author (Andris Reinman) in the package metadata. The postinstall hook runs node lib/utils/index.js, which spawns a detached child process running lib/utils/smtp-connection/index.js. That child fetches a JSON payload from jsonkeeper[.]com/b/QHDXR, extracts the 'cookie' property, and passes it to new Function("require", data.cookie)(require) — a classic remote-code-execution download-and-run pattern. The package also ships an AES-256-CBC decryption module (parse.js) with hardcoded key and IV, plus a 262KB encrypted LICENSE file, providing an alternative offline payload decryption path. The self-dependency (chalk-plus-ts@^1.0.3) is a secondary anomaly; the core threat is the postinstall RCE backdoor.