chalk-pro@7.0.4
Malicious code in chalk-pro (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1059 · Command and Scripting InterpreterT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
Combosquat package "chalk-pro" mimicking the popular chalk terminal library. On postinstall, it spawns a detached background Node.js process (outlives the npm install) that fetches second-stage code from hxxps://www[.]jsonkeeper[.]com/b/TOAAK and executes it via new Function("require", r.data.cookie)(require) — full remote code execution with the Node.js require() scope available. A 262KB hex-encoded file is bundled as "LICENSE" alongside, providing additional payload material for the remote stage.
- analyzed by
- Leitwacht
- first seen
- Jun 12, 2026, 07:55 PM
- analyzed
- Jun 12, 2026, 07:56 PM
Related advisories
- prisma-callback@1.0.0
- poxios-chain@1.3.5
- coral-wraith@1.0.4
- npm-scanner@1.0.0
- node-pino@2.3.2
- node-env-resolver-dotenvx@1.0.1
- nodecheck-health@1.0.0
- nj-logger@1.3.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.