chromatitle-js

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173)
src/index.js unconditionally invokes _bootstrap() from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with javascript-obfuscator (400-entry rotating string-array decoder, hex-escaped identifiers, self-defending wrapper, control-flow flattening) and imports the full download-and-execute primitive set: https.get/http.get, fs.createWriteStream, fs.mkdirSync, fs.chmodSync, fs.unlinkSync, os.tmpdir, and child_process.execFile/spawn. The destination URL, dropped filename, and executed argv are reconstructed at runtime from the obfuscated string array, so the network target and payload are concealed from static inspection. package.json declares javascript-obfuscator as a devDependency and defines an `obfuscate` build script, confirming the concealment is deliberate. The advertised purpose of the package is terminal string coloring / title setting, which does not require fetching or executing a binary at import time. Any consumer that imports chromatitle-js triggers the fetch-and-execute chain on the installer's machine.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/chromatitle-js/MAL-2026-17174.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c93fda3f08313c598165839b4fb8b4d4d912f27a/osv/malicious/npm/chromatitle-js/MAL-2026-17174.json
- https://www.npmjs.com/package/chromatitle-js/v/1.0.0
- https://github.com/advisories/GHSA-93mr-5j8f-6p3w

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.