MAL-2026-17226

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/figlet-chalk-render/MAL-2026-17226.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-17226

Published

2026-09-28T18:07:55Z

Modified

2026-09-28T18:30:05Z

Summary

Malicious code in figlet-chalk-render (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f)

The package is advertised as a chalk+figlet wrapper but index.js contains a top-level IIFE that runs on require. On Windows hosts, it reconstructs the module names 'https', 'os', 'fs', 'path', and 'child_process' and the method name 'spawn' from char-code arrays, hex escapes, and string concatenation to hide the network and execution chain. It then decodes the hardcoded plain-HTTP URL http://104.234.65.75:700/setup.exe and the filename RuntimeBroker.exe (masquerading as a legitimate Windows binary), downloads the payload into the OS temp directory via https.get piped to createWriteStream, and spawns it detached with windowsHide: true and.unref(). Execution is gated to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS are set, evading sandbox and CI analysis. The obfuscation, bare-IP plain-HTTP delivery, RuntimeBroker.exe masquerade, and CI-evasion gate are inconsistent with the package's stated purpose and match an install/require-time Windows dropper.

Database specific

{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020607",
            "import_time":  "2026-09-28T18:24:40.544400227Z",
            "modified_time":  "2026-09-28T18:07:55Z",
            "sha256":  "992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.1"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/figlet-chalk-render/v/1.2.1

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / figlet-chalk-render

Package

Name: figlet-chalk-render; View open source insights on deps.dev
Purl: pkg:npm/figlet-chalk-render

Affected ranges

Affected versions

1.*

1.2.1

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "b07a748c696cdd82d0e1b600e32a8539eedfb6511556c9817770e06d3ac36e61",
            "tlsh":  "0041d006b9fb71310177b0e2a317542a2256e90332c9c2e07b9d9359afca235e5d36dc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "figlet-chalk-render-1.2.1.tgz",
            "hashes":  {
                "sha1":  "fb61281c5aa920799c26e5ac55efb0c68cc9970a",
                "sha512_sri":  "sha512-47jYuE2NQLtCPLZaXzh2hE6QNXhLojy58//4b3CKvDmWdPaveUVDCAJWLdIwNVtn9VkH7XSO+rxnYiFtSooZAg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/figlet-chalk-render/MAL-2026-17226.json"