MAL-2026-15814
Malicious code in chromatitle-dev (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941) src/index.js unconditionally calls bootstrap() at module load. On win32, src/utils/bootstrap.js base64-decodes a URL, filename, and staging directory (stored in an _S object and decoded via Buffer.from(str,'base64').toString('utf-8')) that resolve to https://github.com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win.exe, %USERPROFILE%\Desktop\.chromatitle\installer-win.exe, and.chromatitle. The file is downloaded and spawned with stdio:inherit. The destination repository is unrelated to the package's stated purpose of terminal color/title formatting, is owned by an account named 'realscamgroup', and the URL/filename/directory are base64-encoded solely to hide these indicators from static string scanning. Any Windows consumer that require()s or import()s chromatitle-dev executes the fetched binary automatically.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for chromatitle-dev (npm). Pin to a known-safe version or switch to an alternative.