MAL-2026-15814

    Dashboard / Malicious Package / MAL-2026-15814

    MAL-2026-15814

    Published: 2 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in chromatitle-dev (npm)

    Details: The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. Source: amazon-inspector (b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941) src/index.js unconditionally calls bootstrap() at module load. On win32, src/utils/bootstrap.js base64-decodes a URL, filename, and staging directory (stored in an _S object and decoded via Buffer.from(str,'base64').toString('utf-8')) that resolve to https://github.com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win.exe, %USERPROFILE%\Desktop\.chromatitle\installer-win.exe, and.chromatitle. The file is downloaded and spawned with stdio:inherit. The destination repository is unrelated to the package's stated purpose of terminal color/title formatting, is owned by an account named 'realscamgroup', and the URL/filename/directory are base64-encoded solely to hide these indicators from static string scanning. Any Windows consumer that require()s or import()s chromatitle-dev executes the fetched binary automatically.

    References: https://www.npmjs.com/package/chromatitle-dev/v/1.0.0

    Affected packages

    Package

    Name: chromatitle-dev

    Purl: pkg:npm/chromatitle-dev

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0