Malicious code in chromatitle-dev (npm)

The 'chromatitle-dev' npm package version 1.0.0 includes malicious code in src/utils/bootstrap.js that base64-decodes a URL, filename, and staging directory to download a Windows executable from 'https://github.com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win.exe'. This executable is saved to the user's desktop and spawned with inherited stdio. The malicious payload executes automatically when the package is imported or required on Windows platforms. The obfuscation via base64 encoding is intended to evade static detection. The external repository hosting the payload is unrelated to the package's legitimate purpose and is controlled by a suspicious actor named 'realscamgroup'.

Any Windows user who installs and imports or requires 'chromatitle-dev' version 1.0.0 will have a malicious executable downloaded and executed on their system without consent. This results in arbitrary code execution, potentially compromising the affected system. The malicious payload is delivered from an external source controlled by a threat actor, increasing the risk of further malicious activity.

No official patch or remediation is currently available for 'chromatitle-dev' version 1.0.0. Users should immediately avoid installing or using this package. Remove any existing installations of 'chromatitle-dev' version 1.0.0 from Windows systems. Monitor for any suspicious activity related to the execution of unknown binaries from the user's desktop or the '.chromatitle' directory. Consider using trusted package sources and verifying package integrity before installation.