registry / chromatitle-dev / 1.0.0

chromatitle-dev@1.0.0

Estilização elegante de títulos, banners, badges e gradientes no terminal Node.js.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A normal import on Windows silently retrieves and executes a remote Windows executable. This is unrelated to terminal-title rendering.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package entry point or invoking its CLI, which imports that entry point, on Windows.

Impact

Remote code can run with the permissions of the importing user.

Mechanism

Obfuscated remote executable download followed by child-process execution.

Attack narrative

The exported entry point invokes bootstrap during import. On Windows, bootstrap creates a hidden-looking Desktop directory, decodes an obscured GitHub release URL and executable name, downloads installer-win.exe if absent, then launches it. The package provides terminal styling functions, so this unrelated import-time remote binary execution is a concrete malicious payload chain.

Rationale

The package contains an automatic, obfuscated download-and-execute path for a remote Windows binary during normal import. It has no legitimate relationship to the advertised formatting library.

Evidence

src/index.jssrc/utils/bootstrap.jsDesktop/.chromatitleDesktop/.chromatitle/installer-win.exe

Network endpoints1

github.com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win.exe

chromatitle-dev@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code