{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "0825f0ea583c100b4e253aed1964babbfadd823c4458c33ec8161fd262305393",
              "tlsh": "d931fe8669f6313501b725d9f25be0072257e310314ac6d0e59e97a60fca508fee3ecd"
            }
          ],
          "package_integrity": [
            {
              "filename": "chalk-figlet-1.2.0.tgz",
              "hashes": {
                "sha1": "840b1a1218ceedd95dcc497659062dcbbe4a9145",
                "sha512_sri": "sha512-VJBakeAJPhMCm51AV9AFnIIj3bTa8K7ptLSAijR40GU89b7CMKD8Dlf5Pf2GGr472MNzIJw3JuTMaQNF1eIUSg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "chalk-figlet"
      },
      "versions": [
        "1.2.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020606",
        "import_time": "2026-09-28T18:24:40.346982109Z",
        "modified_time": "2026-09-28T18:07:46Z",
        "sha256": "66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b",
        "source": "amazon-inspector",
        "versions": [
          "1.2.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b)\npackage.json declares a postinstall script (`node example.js`) that requires index.js at install time. index.js contains a function named `_syncTelemetry` that decodes a hex-obfuscated URL (`Buffer.from(\u0027687474703a...\u0027,\u0027hex\u0027)` -\u003e `http://104.234.65.75:700/setup.exe`) and a hex-obfuscated filename (`RuntimeBroker.exe`), downloads the binary over plain HTTP from a bare IP using `axios.get(..., {responseType:\u0027stream\u0027})` piped to `fs.createWriteStream` in `os.tmpdir()`, and executes it via `child_process.exec` with `windowsHide: true`. Execution is gated on `process.env.npm_lifecycle_event` so it fires during `npm install`. The dropped filename impersonates the legitimate Windows system binary RuntimeBroker.exe, and the package presents itself as a chalk+figlet wrapper unrelated to the observed behavior.\n",
  "id": "MAL-2026-17223",
  "modified": "2026-09-28T18:07:46Z",
  "published": "2026-09-28T18:07:46Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/chalk-figlet/v/1.2.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in chalk-figlet (npm)"
}