chalk-es @1.0.0

Summary

Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js . On install the script XOR-decodes (key stf2026 ) a hardcoded GitHub URL and downloads a Windows binary to %TEMP%\main.exe , then spawns it detached. On WSL/Linux hosts an XOR-decoded bridge command is exec'd to reach the underlying Windows host and run the same payload from inside Linux. The postinstall also POSTs a JSON body containing the resolved platform label (with WSL detection) to a hardcoded bare-IP endpoint at http://193.70.34.101:20099/vote , serving as an install beacon/victim tracker. Four byte-array constants (ADDON_ENC, BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) are XOR-decoded at runtime specifically to hide the fetch URL and the Windows/WSL execution command.

Source: amazon-inspector (9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc)