chalk-ultra@12.0.14

Analysis

The package chalk-ultra@12.0.14 is a combosquat of the legitimate "chalk" library that executes remote code via a postinstall hook. On npm install, the postinstall script (lib/utils/index.js) spawns a detached background Node.js process running lib/utils/smtp-connection/index.js. This payload fetches attacker-controlled code from hxxps://jsonkeeper[.]com/b/IYUCS and executes it via new Function("require", ...)(require), giving the remote code full access to Node.js require. The package also ships a 262KB hex-encoded blob as a LICENSE file, likely an encrypted second-stage payload. The package masquerades as the nodemailer library (author "Andris Reinman", main entry lib/nodemailer.js) despite the chalk-ultra name being a combosquat of "chalk".