MAL-2026-16322

    Dashboard / Malicious Package / MAL-2026-16322

    MAL-2026-16322

    Published: 21 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in @siriusbeyond/utils (npm)

    Details: Source: amazon-inspector (330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689) Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance (hostname, username, platform, cwd, home directory, UID, CI/cloud fingerprints) and enumerates process.env keys matching credential regexes (/token/i, /secret/i, /key/i, /password/i, /auth/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i, /registry/i, /artifactory/i, /nexus/i, /credential/i), taking up to 20 matches, and POSTs the collected payload via https.request to api.telegram.org /bot<token>/sendMessage using a hardcoded Telegram bot token (8605555117) and chat id (1064260758). The version number 99.0.0 and the exfiltration behavior are consistent with a dependency-confusion attack against an internal @siriusbeyond scope. The activity fires automatically on default npm install with no user action.

    References: https://www.npmjs.com/package/@siriusbeyond/utils/v/99.0.0

    Affected packages

    Package

    Name: @siriusbeyond/utils

    Purl: pkg:npm/%40siriusbeyond/utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0