@siriusbeyond/auth

GHSA-5x48-2mvx-rc23

Malicious code in @siriusbeyond/auth (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695)
Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every `npm install`. callback.js collects installer host identifiers (hostname, username, platform, cwd, homedir, CI/cloud indicators, npm registry) together with a filtered list of environment variable names matching token/secret/key/password/aws/npm/git patterns, and POSTs a Markdown report to https://api.telegram.org/bot<token>/sendMessage using a hardcoded bot token and chat_id 1064260758 embedded in the source. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the beacon from install output. The version number 99.0.0 and private-scope name are the standard dependency-confusion shape targeting the `@siriusbeyond` scope, causing internal builds that reference that scope to resolve to this public package and beacon out. The package's self-description as a 'Dependency Confusion PoC / security research' does not change the runtime behavior: installer-owned data leaves every machine that installs it to an author-controlled Telegram channel.

## Source: ossf-package-analysis (1d6b359a24803199b8b8cbc77aed1c8ceac0706a76db4ec00a9964bf1f8b1e37)
The OpenSSF Package Analysis project identified '@siriusbeyond/auth' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d01152371c0ae806b74fc03a3f4d821a3fd6770c/osv/malicious/npm/@siriusbeyond/auth/MAL-2026-16320.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d01152371c0ae806b74fc03a3f4d821a3fd6770c/osv/malicious/npm/@siriusbeyond/auth/MAL-2026-16320.json
- https://www.npmjs.com/package/@siriusbeyond/auth/v/99.0.0
- https://github.com/advisories/GHSA-5x48-2mvx-rc23

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.