MAL-2026-17223

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalk-figlet/MAL-2026-17223.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17223
Published
2026-09-28T18:07:46Z
Modified
2026-09-28T18:30:06Z
Summary
Malicious code in chalk-figlet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b)

package.json declares a postinstall script (node example.js) that requires index.js at install time. index.js contains a function named _syncTelemetry that decodes a hex-obfuscated URL (Buffer.from('687474703a...','hex') -> http://104.234.65.75:700/setup.exe) and a hex-obfuscated filename (RuntimeBroker.exe), downloads the binary over plain HTTP from a bare IP using axios.get(..., {responseType:'stream'}) piped to fs.createWriteStream in os.tmpdir(), and executes it via child_process.exec with windowsHide: true. Execution is gated on process.env.npm_lifecycle_event so it fires during npm install. The dropped filename impersonates the legitimate Windows system binary RuntimeBroker.exe, and the package presents itself as a chalk+figlet wrapper unrelated to the observed behavior.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020606",
            "import_time":  "2026-09-28T18:24:40.346982109Z",
            "modified_time":  "2026-09-28T18:07:46Z",
            "sha256":  "66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chalk-figlet

Package

Name
chalk-figlet
View open source insights on deps.dev
Purl
pkg:npm/chalk-figlet

Affected ranges

Affected versions

1.*
1.2.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "0825f0ea583c100b4e253aed1964babbfadd823c4458c33ec8161fd262305393",
            "tlsh":  "d931fe8669f6313501b725d9f25be0072257e310314ac6d0e59e97a60fca508fee3ecd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chalk-figlet-1.2.0.tgz",
            "hashes":  {
                "sha1":  "840b1a1218ceedd95dcc497659062dcbbe4a9145",
                "sha512_sri":  "sha512-VJBakeAJPhMCm51AV9AFnIIj3bTa8K7ptLSAijR40GU89b7CMKD8Dlf5Pf2GGr472MNzIJw3JuTMaQNF1eIUSg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalk-figlet/MAL-2026-17223.json"