How termchalk , a typosquatted version of the popular chalk library Turns Your Terminal into a Spyglass

In modern software development, We’ve often treated import and require as passive statements—mere pointers to the tools We need to build our apps. But with my recent malware analysis within the Uptycs platform reveals, an import is a silent execution of trust that can be weaponized against an entire infrastructure.

I recently analyzed **termchalk**, a typosquatted version of the popular chalk library. On the surface, it’s a terminal styling utility. Under the hood, I found a sophisticated data stealer and backdoor.

The Smoking Gun: My Runtime Anomaly Detection

The screenshot below from Uptycs XDR Platform shows the exact moment of infection. This was my “Aha!” moment: a standard node process, triggered by a simple require('termchalk'), suddenly reached out to modify /root/.ssh/authorized_keys.

In any healthy ecosystem, a logging or styling utility has no business touching SSH configurations. This violation of the “Principle of Least Privilege” is the hallmark of a supply chain attack I caught in real-time.

The Attack Workflow: From Import to Exfiltration

My analysis revealed a six-stage lifecycle that takes the attacker from the node_modules folder to sensitive corporate data.

1. The Stealthy Entry (Dependency Confusion)

I discovered that termchalk hides its malicious payload inside a sub-dependency named prettlog. By keeping the top-level package "clean," it successfully evades static manifest scanners that only check the primary package.json.

2. The Import-Time Trigger

The malware executes the second I require the package. Using setImmediate, it pushes its malicious tasks to the next turn of the event loop. This allows the host application to load normally, masking the backdoor installation happening in the background.

3. Establishing Persistence (The SSH Backdoor)

I watched as the script targeted the ~/.ssh/authorized_keys file, appending a hardcoded public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEUInKrdaCOL... The Result: The attacker now has permanent, passwordless SSH access to the machine.

4. Recursive Reconnaissance

The malware initiated a deep crawl of my file system. It ignored “noisy” directories but aggressively targeted:

• Secrets: .env files and cloud credentials.
• Targeted Projects: It specifically looked for files like clob.ts or createClobClient.ts, indicating a focus on DeFi/Crypto developers.

5. Data Siphoning & Exfiltration

I tracked the data as it was read, converted to Base64, and sent via HTTP POST to a remote C2 server (api.suffle.bet). The code even included logic to chunk the data to avoid triggering network size alerts.

Why This Matters for AppSec Teams

This incident highlights a shift in malware tactics that I believe every security professional should be aware of:

• Moving Beyond Postinstall: Scanners that only look for postinstall scripts will miss this. This code lives in the execution logic of the application itself.
• The Need for Runtime Visibility: Static analysis is no longer enough. I’ve found that you need tools that monitor behavioral anomalies at the system call level to catch this.

Indicators of Compromise (IoCs)

If you are investigating a potential compromise, look for these markers I identified:

• SSH: The presence of user@DESKTOP-71KAE1T in your authorized keys.
• Network: Outbound traffic to [https://api.suffle.bet.](https://api.suffle.bet.)
• Filesystem: A dependency named prettlog in your lockfiles.
• npm packages involved : termchalk , prettlog

Final Thought

A library that colors my terminal should live and die in the terminal. The moment it starts browsing my SSH keys, the “supply chain” has been exposed for what it really is: a supply pipe pumping my secrets to a remote C2. Vigilance isn’t just about scanning manifests; it’s about auditing runtime behavior. I’ve learned the hard way: never trust a package just because the name feels like home.

Uptycs #CyberSecurity #ThreatIntel #NodeJS #AppSec #SupplyChainAttack