chalks-log (npm): malicious logging package fully compromises machines that install it (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's malware advisory database published GHSA-cm5x-2764-c8p9 on 2026-11-11 flagging the npm package chalks-log as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning the attacker may have obtained full control, including access to secrets and keys. The package has low reach (~216 downloads/month) despite a claimed 23K GitHub stars, suggesting a typosquat or impersonation of a popular logging library. Removal of the package does not guarantee removal of all malicious software it installed. No fix is available; remediation is removal plus credential rotation.
What to do
- Remove chalks-log from all projects and machines immediately
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Rebuild/reimage compromised machines; do not assume package removal removes the malware
- Audit dependency trees and lockfiles for chalks-log and block it in CI/registry policy
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
