chromatitle-dev (v1.0.0) appeared on the npm registry on Aug 31, 2026, published by the account itzchroma (manustop19282[@]gmail[.]com). The package presents itself as a terminal color and title styling library. It ships functional formatting code, a CLI with Portuguese help text, TypeScript declarations, and a README that references a different package name. A function in src/utils/bootstrap.js downloads a Windows executable from a GitHub release and runs it on every import.
The artifact
Version 1.0.0 is the only release. The author field in package.json reads “chromadev.” The README instructs users to run npm install chromatitle-js, not chromatitle-dev. The repository field points to hxxps://github[.]com/seu-usuario/chromatitle, which returns a 404. “Seu-usuario” is Portuguese for “your-username,” a template placeholder the publisher did not replace.
Eighteen files totaling 30,400 bytes. The src/colors/ directory contains a working ANSI color chain with hex-to-RGB conversion and per-character gradient rendering. src/titles/ builds bordered boxes, banners, badges, and dividers using Unicode box-drawing characters. bin/cli.js provides a full CLI with argument parsing, entirely in Portuguese (“Ferramenta de títulos, banners e cores no terminal”). types/index.d.ts provides TypeScript definitions for every export. The functional surface is real enough to pass a quick review.
The package declares zero npm dependencies and no lifecycle scripts.
What it does
The entry point src/index.js imports bootstrap from ./utils/bootstrap.js and calls it immediately:
import { bootstrap } from './utils/bootstrap.js';
bootstrap();Any project that runs import ... from 'chromatitle-dev' triggers the payload before the consuming code evaluates any export.
bootstrap.js stores three base64-encoded strings in an object called _S:
| Key | Encoded | Decoded |
|---|---|---|
_S.u | aHR0cHM6Ly9naXRodWIuY29tL3... | hxxps://github[.]com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win[.]exe |
_S.f | aW5zdGFsbGVyLXdpbi5leGU= | installer-win.exe |
_S.d | LmNocm9tYXRpdGxl | .chromatitle |
The function checks process.platform. On anything other than win32 it returns silently. On Windows it follows four steps:
- Creates
%USERPROFILE%\Desktop\.chromatitle\if it does not exist. - Downloads the decoded URL via
fetch(), following redirects, with the User-Agent stringchromatitle-js. - Writes the response body to
%USERPROFILE%\Desktop\.chromatitle\installer-win.exe. - Calls
spawn(path, [], { stdio: "inherit" })on the downloaded binary.
A boolean flag _init prevents re-execution within the same process. Errors are caught and logged as [chromatitle] Bootstrap error:, blending with the legitimate library output.
The package carries no preinstall, postinstall, or install script. Because execution depends on the consuming code importing the module rather than on a lifecycle hook, the payload survives --ignore-scripts and any install-time defense that relies on blocking lifecycle scripts. The trigger is application runtime, not install time.
The download URL points to a GitHub release under the organization realscamgroup. The repository name Discord-Bypass-Brasil and the release directory Dependencia (Portuguese for “dependency”) match the Portuguese language throughout the package. The User-Agent used in the download request is chromatitle-js, matching the name in the README rather than the published package name.
The campaign
This analysis covers one artifact. The GitHub organization realscamgroup and its Discord-Bypass-Brasil repository serve as payload infrastructure. The consistent Portuguese language across the package README, CLI help text, template repository URL, and GitHub release directory name points to a Portuguese-speaking operation using npm as one distribution channel for a Windows-targeted binary.
Why the operation matters here
Registry-level defenses that block lifecycle scripts do not catch this package. The dropper fires on import, which means it runs at application runtime under whatever privileges the consuming process holds. The functional terminal library masks the payload during a manual review: a developer checking the package would find real box-drawing, gradient, and badge code across multiple well-organized source files with TypeScript types.
What a defender can do
Flag packages whose README references a different package name. Treat a broken or template repository URL as a signal. Review transitive dependencies for unexpected child_process and fs imports in utility files. On Windows, monitor %USERPROFILE%\Desktop\ for hidden directories created by Node processes.
Where Aephix fits
Aephix Vantage gives you a free cross-ecosystem check before you install. Weekly Sleuth reports the week’s confirmed artifacts and the campaigns they belong to, so a second package from the same staging infrastructure is recognized on arrival.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | [email protected] | Dropper disguised as terminal styling library |
| npm account | itzchroma | Publisher |
| manustop19282[@]gmail[.]com | Publisher email | |
| Author field | chromadev | package.json author |
| Download URL | hxxps://github[.]com/realscamgroup/Discord-Bypass-Brasil/releases/download/Dependencia/installer-win[.]exe | Payload binary |
| GitHub org | realscamgroup | Hosts payload release |
| GitHub repo | Discord-Bypass-Brasil | Hosts payload release |
| Claimed repo | hxxps://github[.]com/seu-usuario/chromatitle | Placeholder, returns 404 |
| Dropped file | installer-win.exe | Windows binary executed via spawn() |
| Staging directory | %USERPROFILE%\Desktop.chromatitle\ | Created by bootstrap.js |
| User-Agent | chromatitle-js | Used in payload download request |
| SHA-1 (tarball) | 78ad370481f7fbeac773307c52e553f383cc4ba7 | npm package tarball |