MAL-2026-10134

Dashboard / Malicious Package / MAL-2026-10134

MAL-2026-10134

Summary: Malicious code in stella-coder (npm)

Details: Source: amazon-inspector (f0c3ed879ef15a68d537ad7b6ddb59508aba58eee49c8ca19b916ef59a0c2da6) stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token (BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0") that is controlled by the package author. When the user invokes the /tg CLI command, the package starts a Telegram bot on the installer's machine that receives messages over api.telegram.org and passes them into execSync(`node stella-cli/index.mjs -p "${text}"`), invoking a shell-capable AI agent CLI with attacker-supplied input. Because the messaging channel is bound to a token the author retains, the author observes all bot traffic — including the 4-digit admin authorization code exchanged over that same channel — and can replay it to reach the command-execution path on any installer that enables /tg. telegram-bot.mjs additionally sends os.hostname() and os.userInfo().username to the same author-controlled bot. A hardcoded PREMIUM_CODE = "10102013" acts as a universal activation key that unlocks the remote-control feature-set without payment. package.json sets "main": "stella-cli/index.mjs", whose top-level executes main() and starts the interactive CLI on require/import, extending the reach of the /tg surface beyond the bin entry. There are no install lifecycle hooks; the backdoor fires when the user runs the CLI (or a consumer imports the module) and invokes /tg.

References: https://www.npmjs.com/package/stella-coder/v/5.0.0, https://www.npmjs.com/package/stella-coder/v/5.1.0, https://www.npmjs.com/package/stella-coder/v/5.1.1, https://www.npmjs.com/package/stella-coder/v/4.0.0, https://www.npmjs.com/package/stella-coder/v/5.0.1, https://www.npmjs.com/package/stella-coder/v/5.1.2, https://www.npmjs.com/package/stella-coder/v/5.2.0, https://www.npmjs.com/package/stella-coder/v/5.3.3, https://www.npmjs.com/package/stella-coder/v/5.3.4, https://www.npmjs.com/package/stella-coder/v/5.3.5, https://www.npmjs.com/package/stella-coder/v/5.3.6