npm · Malicious package advisory
Malware@siriusbeyond/utils
MAL-2026-16322
Malicious code in @siriusbeyond/utils (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689) Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance (hostname, username, platform, cwd, home directory, UID, CI/cloud fingerprints) and enumerates process.env keys matching credential regexes (/token/i, /secret/i, /key/i, /password/i, /auth/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i, /registry/i, /artifactory/i, /nexus/i, /credential/i), taking up to 20 matches, and POSTs the collected payload via https.request to api.telegram.org /bot<token>/sendMessage using a hardcoded Telegram bot token (8605555117) and chat id (1064260758). The version number 99.0.0 and the exfiltration behavior are consistent with a dependency-confusion attack against an internal @siriusbeyond scope. The activity fires automatically on default npm install with no user action.
Compromised versions (1)
- 99.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.