{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "b07a748c696cdd82d0e1b600e32a8539eedfb6511556c9817770e06d3ac36e61",
              "tlsh": "0041d006b9fb71310177b0e2a317542a2256e90332c9c2e07b9d9359afca235e5d36dc"
            }
          ],
          "package_integrity": [
            {
              "filename": "figlet-chalk-render-1.2.1.tgz",
              "hashes": {
                "sha1": "fb61281c5aa920799c26e5ac55efb0c68cc9970a",
                "sha512_sri": "sha512-47jYuE2NQLtCPLZaXzh2hE6QNXhLojy58//4b3CKvDmWdPaveUVDCAJWLdIwNVtn9VkH7XSO+rxnYiFtSooZAg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "figlet-chalk-render"
      },
      "versions": [
        "1.2.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020607",
        "import_time": "2026-09-28T18:24:40.544400227Z",
        "modified_time": "2026-09-28T18:07:55Z",
        "sha256": "992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f",
        "source": "amazon-inspector",
        "versions": [
          "1.2.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f)\nThe package is advertised as a chalk+figlet wrapper but index.js contains a top-level IIFE that runs on require. On Windows hosts, it reconstructs the module names \u0027https\u0027, \u0027os\u0027, \u0027fs\u0027, \u0027path\u0027, and \u0027child_process\u0027 and the method name \u0027spawn\u0027 from char-code arrays, hex escapes, and string concatenation to hide the network and execution chain. It then decodes the hardcoded plain-HTTP URL http://104.234.65.75:700/setup.exe and the filename RuntimeBroker.exe (masquerading as a legitimate Windows binary), downloads the payload into the OS temp directory via https.get piped to createWriteStream, and spawns it detached with windowsHide: true and.unref(). Execution is gated to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS are set, evading sandbox and CI analysis. The obfuscation, bare-IP plain-HTTP delivery, RuntimeBroker.exe masquerade, and CI-evasion gate are inconsistent with the package\u0027s stated purpose and match an install/require-time Windows dropper.\n",
  "id": "MAL-2026-17226",
  "modified": "2026-09-28T18:07:55Z",
  "published": "2026-09-28T18:07:55Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/figlet-chalk-render/v/1.2.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in figlet-chalk-render (npm)"
}