GCVE-110-OSM-2026-1594

chalk-ts-logger@6.2.5 is a supply-chain vector that installs chalk-logger-prettier (OSM e9ff9a03-1488-4fff-ab2b-4d14fdfa7995), a confirmed CRITICAL credential stealer, as a required dependency. Both packages are published by the same threat actor (bilalkilnaz.54@gmail.com). Importing chalk-ts-logger triggers chalk-logger-prettier's require-time payload, which steals environment files, cryptocurrency wallet JSON files, Telegram Desktop session data, and injects an attacker SSH public key into ~/.ssh/authorized_keys, all exfiltrated to chalk-logger.vercel.app. dist/logger.js line 1: 'import { logger } from "chalk-logger-prettier"' loads the payload package immediately. chalk-logger-prettier/dist/logger.js fires an IIFE that: (1) fetches public IP via ifconfig.me; (2) POSTs OS/IP/username to chalk-logger.vercel.app/api/validate; (3) reads process.cwd()/.env and POSTs it; (4) recursively crawls home directories for .env files, credential JSONs (key/wallet/mnemonic/seed keywords), and docs; (5) archives and uploads Telegram Desktop tdata; (6) on Linux, injects ssh-ed25519 key into ~/.ssh/authorized_keys. All exfil targets chalk-logger.vercel.app/api/validate via HTTP POST. Additionally, logText() and getDefaultLogger() in chalk-ts-logger call logger.info() directly, providing redundant trigger paths.