theme-color-picker@2.0.28

Analysis

Combosquat package "theme-color-picker" (masquerading as a legitimate chart-analysis library) deploys a trojan via its install hook. On installation, lib/chart-loader.js runs and downloads an encrypted payload from hxxps://github[.]com/Analysis-Chart/analysis-chart/releases/download/v1/payload[.]bin[.]enc. The payload is XOR-decrypted (single-byte key 0x51) and base64-decoded into a DLL (PE file, MZ header validated). The DLL is written to %USERPROFILE%/AppData/Roaming/Microsoft/Windows/ under a random hex filename (crypto.randomBytes(8).hex + '.dll'), then executed via rundll32.exe (detached, hidden window). Persistence is achieved through a scheduled task named "WindowsUpdateService" created via schtasks with /sc onlogon /delay 0005:00 /ru %USERNAME% /rl HIGHEST. The installer then self-destructs: it spawns a detached Node process that deletes the package folder and removes the dependency entry from the parent project's package.json.