MAL-2026-17174

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chromatitle-js/MAL-2026-17174.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17174
Published
2026-09-25T02:32:22Z
Modified
2026-09-25T03:00:06Z
Summary
Malicious code in chromatitle-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173)

src/index.js unconditionally invokes _bootstrap() from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with javascript-obfuscator (400-entry rotating string-array decoder, hex-escaped identifiers, self-defending wrapper, control-flow flattening) and imports the full download-and-execute primitive set: https.get/http.get, fs.createWriteStream, fs.mkdirSync, fs.chmodSync, fs.unlinkSync, os.tmpdir, and child_process.execFile/spawn. The destination URL, dropped filename, and executed argv are reconstructed at runtime from the obfuscated string array, so the network target and payload are concealed from static inspection. package.json declares javascript-obfuscator as a devDependency and defines an obfuscate build script, confirming the concealment is deliberate. The advertised purpose of the package is terminal string coloring / title setting, which does not require fetching or executing a binary at import time. Any consumer that imports chromatitle-js triggers the fetch-and-execute chain on the installer's machine.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020522",
            "import_time":  "2026-09-25T02:45:28.253668216Z",
            "modified_time":  "2026-09-25T02:32:22Z",
            "sha256":  "eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / chromatitle-js

Package

Name
chromatitle-js
View open source insights on deps.dev
Purl
pkg:npm/chromatitle-js

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "src/utils/bootstrap.js",
            "sha256":  "34b527b96ac2da104bd3456e4bfa3b75f6f76146259e43ad07a7421176c9688f",
            "tlsh":  "3e43bfc477c0e40366ce1b63bf06b9e9e13ba8b175c8a5478264b99c64bd517c2b0ef4"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "chromatitle-js-1.0.0.tgz",
            "hashes":  {
                "sha1":  "fa8069c8c4fb6281841785b81d80edc00a10b27d",
                "sha512_sri":  "sha512-sHQCkgMEbZK4pH86WsbkpFL8igIIryCCQNTwP6nDUYFReNhlOAtYOSDmuNxhoKNG3z7r4PihgyXYau/WevaQ9Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chromatitle-js/MAL-2026-17174.json"