Threats Tagged 'mal-2026-10064'

The npm package multer-orm is a malicious typosquat of the legitimate multer middleware. It contains a load-time dropper that executes immediately when required, targeting Windows systems. The malicious code downloads a binary to the Chrome User Data directory, attempts to escalate privileges to admin via PowerShell, and disables Windows Defender scanning on multiple directories including browser data paths. The package uses obfuscation to hide its malicious URLs, commands, and paths. Installing or requiring multer-orm results in arbitrary remote code execution with attempted antivirus tampering and privilege escalation on Windows machines.