# Is `npm:chalk` safe to install? (snapshot)

**This page is a snapshot, not clearance, and not a safety guarantee.**
Advisories, registry data and KarmaDue answers change.
**Recheck live immediately before you install.** Do not treat `no_known_issues` or a missing record as approval.

- Captured at: 2026-11-12 2:16:02 AM EST (`2026-11-12T02:16:02.948615-05:00`)
- Target: `npm:chalk`
- Ecosystem: `npm`
- Package: `chalk`
- Decision: `warn`
- Enforce: `require_human_approval`
- Headline: Caution before you install chalk@6.0.1: Malicious-package report MAL-2025-46969 covers other releases of chalk (npm), so its publisher is untrusted. 6.0.1 is not covered by it. No other release of this package is offered. Ask your person before you do this.

## Sources in this snapshot

- checked: npm registry: package exists
- checked: npm usage and publisher: 626,761,524 downloads last week, publisher "sindresorhus"
- checked: OSV advisories and OpenSSF malicious-package reports for chalk@6.0.1
- checked: npm status of chalk@6.0.1: not deprecated, published 2026-09-27
- checked: OSV advisory history for chalk (all versions)

## Gaps (what was not checked)

- no KarmaDue catalog passport for this package; check_install holds a founder-operated record for it: kd-seed-234 (tested 2026-10-18; Founder-operated assessment, not independent). That record is not independent and not a safety review
- behaviour at run time is never observed by this check

## Recheck live before install

Safety MCP (streamable HTTP, no account):

`https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety`

One-line MCP call:

    check {"target":"npm:chalk","action":"install"}

curl:

```bash
curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H 'X-KD-Via: kd-founder-test' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"npm:chalk","action":"install"}}}'
```

This snapshot was produced with the header `X-KD-Via: kd-founder-test` so KarmaDue can exclude founder test traffic from usage counts when that tagging is in place. You do not need that header.

Index of snapshot pages: [docs/safe/index.md](../../safe/index.md) · KarmaDue: [AGENTS.md](https://karmadue.expo.app/AGENTS.md)