chalk-ultra@12.0.3

Analysis

chalk-ultra@12.0.3 is a combosquat of the popular chalk package that executes a remote code downloader on install. The postinstall script spawns a detached background Node.js process which fetches a payload from hxxps://jsonkeeper[.]com/b/AD9A2 via HTTP GET and evaluates the response's .cookie field as JavaScript using the Function constructor with full require access — enabling arbitrary code execution controlled by the remote endpoint. The package also ships a 262KB hex-encoded binary blob as a LICENSE file, consistent with encoded payload storage. The C2 URL (jsonkeeper[.]com/b/AD9A2) serves the dynamic stage-2 payload.