GCVE-110-OSM-2026-11545

This is a downloader/dropper for a Windows payload: `src/utils/bootstrap.js` base64-decodes a GitHub release URL, writes `installer-win.exe` to `%USERPROFILE%\Desktop\.chromatitle`, and then spawns it with `stdio: "inherit"`. The attacker model is a supply-chain implant targeting npm consumers on Windows; the package’s stated terminal-formatting purpose is unrelated to fetching and executing a foreign EXE from `realscamgroup/Discord-Bypass-Brasil`. The static evidence also shows obfuscation (`Buffer.from(str, "base64")`, hidden strings, decoded IOC) and system info collection via `process.platform`, with the bootstrap path triggered from module load per the advisory context. This aligns with a malicious loader intended to execute a staged binary on import/require, not a benign installer or telemetry helper. ENTRY bin/cli.js (bin: ./bin/cli.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in src/utils/bootstrap.js: "process.platform" OBFUSCATION - Decoded Base64 Content in src/utils/bootstrap.js (x2) - Decoded Base64 Content in [deobfuscated] src/utils/bootstrap.js (x2) - Dynamic Base64 Decoding in src/utils/bootstrap.js: "Buffer.from(str, "base64")" - Base64 Encoded Payload in src/utils/bootstrap.js: ""aHR0cHM6Ly9naXRodWIuY29tL3JlYWxzY2FtZ3JvdXAvRGlzY29yZC1CeXBhc3MtQnJhc2lsL3JlbGV..." - Strings Extracted from Deobfuscated Code in src/utils/bootstrap.js - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Stream Response to Execution in src/utils/bootstrap.js: "createWriteStream(path); await finished( Readable.fromWeb(r.body).pipe(s) ); } e..." - Very New NPM Publisher Account PAYLOAD FILES src/utils/bootstrap.js (+ [deobfuscated] src/utils/bootstrap.js)