MAL-2026-15813

    Dashboard / Malicious Package / MAL-2026-15813

    MAL-2026-15813

    Published: 1 Sept 2026Last Modified: 3 Sept 2026

    Summary: Malicious code in bt2-api-gateway-node-js (npm)

    Details: Source: amazon-inspector (1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b) [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens — and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot<token>/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5–15 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal 'bt2-api-gateway' package. Source: ossf-package-analysis (e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e) The OpenSSF Package Analysis project identified 'bt2-api-gateway-node-js' @ 999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.1, https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.0

    Affected packages

    Package

    Name: bt2-api-gateway-node-js

    Purl: pkg:npm/bt2-api-gateway-node-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.1
    999.0.0