figlet-chalk-render

GHSA-frpq-rj8q-hpr4

Malicious code in figlet-chalk-render (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.2.1`

## Source: amazon-inspector (992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f)
The package is advertised as a chalk+figlet wrapper but index.js contains a top-level IIFE that runs on require. On Windows hosts, it reconstructs the module names 'https', 'os', 'fs', 'path', and 'child_process' and the method name 'spawn' from char-code arrays, hex escapes, and string concatenation to hide the network and execution chain. It then decodes the hardcoded plain-HTTP URL http://104.234.65.75:700/setup.exe and the filename RuntimeBroker.exe (masquerading as a legitimate Windows binary), downloads the payload into the OS temp directory via https.get piped to createWriteStream, and spawns it detached with windowsHide: true and.unref(). Execution is gated to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS are set, evading sandbox and CI analysis. The obfuscation, bare-IP plain-HTTP delivery, RuntimeBroker.exe masquerade, and CI-evasion gate are inconsistent with the package's stated purpose and match an install/require-time Windows dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9c4594ea270f8ce1185755115d5eb811c41d8589/osv/malicious/npm/figlet-chalk-render/MAL-2026-17226.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/9c4594ea270f8ce1185755115d5eb811c41d8589/osv/malicious/npm/figlet-chalk-render/MAL-2026-17226.json
- https://www.npmjs.com/package/figlet-chalk-render/v/1.2.1
- https://github.com/advisories/GHSA-frpq-rj8q-hpr4

Compromised versions (1)

= 1.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.