Hostile 100% javascript Download

chalk-ultra 12.0.14

Remote code execution via axios

AST-confirmed decryptor with embedded keysExported decryptor module with embedded keys
SHA-256d2f8b73f24f8bfebddf8db01fd85f038072843e10bb6f29383312e2b2b9f103b
URLhttps://registry.npmjs.org/chalk-ultra/-/chalk-ultra-12.0.14.tgz
MaleculeK(Li₂)O₅(S₄As₂C₂CaEr)H₇(Cr₅Cm₂₆Db₁₄F₄Os₅Po₇Ti)Md₂(InPa₄)

Also flagged by osv (MAL-2026-6300: Malicious code in chalk-ultra (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.