MAL-2026-3674

    Dashboard / Malicious Package / MAL-2026-3674

    MAL-2026-3674

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in 66o (npm)

    Details: Source: amazon-inspector (c3ba0e9f968d627812a2a4efbb8631d3400b6c19692c7668c8e511e2808aaa62) On `require()`, index.js replaces the global `console` object with a Proxy (index.js:36-73) that intercepts console.error/info/warn calls anywhere in the host process and POSTs their serialized content (up to 4090 chars) to https://api.telegram.org/bot<redacted-token>/sendMessage?chat_id=5043676235. It additionally installs a `process.on('uncaughtException', err => console.error(err))` handler (index.js:3-10), ensuring that any uncaught exception in the installer's application — which commonly includes file paths, environment values, SQL fragments, and request payloads in stack traces — is routed through the same exfiltration channel to an author-controlled Telegram chat. A secondary global `U`/`F` function (index.js:75-83) writes caller-supplied objects to an author-owned Firebase Realtime Database (iiilll.firebaseio.com). The hardcoded Telegram bot token and imgbb API key in the source are the credentials backing this relay, not merely author-leaked secrets. Any consumer that `require`s this package silently has their log and error stream piped to a third party without consent — a textbook silent-relay / data exfiltration supply-chain attack.

    References: https://www.npmjs.com/package/66o/v/0.0.3, https://www.npmjs.com/package/66o/v/0.0.196, https://www.npmjs.com/package/66o/v/0.0.197, https://www.npmjs.com/package/66o/v/0.0.18, https://www.npmjs.com/package/66o/v/0.0.192, https://www.npmjs.com/package/66o/v/0.0.5

    Affected packages

    Package

    Name: 66o

    Purl: pkg:npm/66o

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.3
    0.0.196
    0.0.197
    0.0.18
    0.0.192
    0.0.5
    MAL-2026-3674 | CVE-DB