chalk-plus-ts@1.0.4

Analysis

chalk-plus-ts is a combosquat of the popular 'chalk' package. On npm install, the postinstall hook (node lib/utils/index.js) spawns a detached Node.js process that reads a padded LICENSE file, then fetches a remote payload from api[.]jsonbin[.]io/v3/b/6a461991f5f4af5e295272d4 and executes it via new Function() — a remote code execution dropper. The fetched payload runs with full access to the 'require' function, enabling arbitrary code execution in the installer's context. The package has no repository, no verifiable publisher identity, and impersonates the nodemailer ecosystem.