LWA-2026-11809 confirmed malware
chromatitle@1.0.0
Malicious code in chromatitle (npm)
T1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web ProtocolsT1204.002 · Malicious File
Analysis
chromatitle@1.0.0, a terminal banner/color CLI, executes a hidden download-and-execute payload automatically when the module is imported. Its bundled src/utils/bootstrap.js is heavily obfuscated (encoded string array with a custom decoder) and imports child_process execFile, http/https get, and fs write/chmod/unlink/mkdir. On import it fetches a remote file from an obfuscated URL (with a query parameter), writes it to the OS temp directory, chmods it executable, and executes it via execFile. The remote host is encoded inside the obfuscated string array.
- analyzed by
- Leitwacht
- first seen
- Aug 31, 2026, 08:40 PM
- analyzed
- Aug 31, 2026, 08:41 PM
Related advisories
- @syncraft-labs/vue@0.4.1
- @wizloft/harness-kernel@0.1.1-alpha.3
- @wizloft/harness-context@0.1.1-alpha.3
- @wizloft/harness@0.1.1-alpha.3
- cc-skills-helper@1.0.0
- dolyame-boxy-mobile-bnpl-card-panel@35.3.4
- bnpl-blocks-atom-desktop-bnpl-text@35.2.5
- bigops-products-bnpl@35.2.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.