MAL-2026-3676

    Dashboard / Malicious Package / MAL-2026-3676

    MAL-2026-3676

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in 88q (npm)

    Details: Source: amazon-inspector (cb830829cae1605ff7626653a2470db03cd5a5aab98b3f0a7f5912eaf244561b) The main entrypoint index.js runs an IIFE at require time that monkey-patches the global console.warn and console.error methods. After the override, every subsequent console.warn/console.error call in the host process causes the first argument to be JSON-stringified, URL-encoded, and sent via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with hardcoded chat_ids (-1001161709623 for warn, -1001433099398 for error). The package exports only the undefined return value of the IIFE and provides no legitimate API, meaning its sole effect is the silent installation of a global diagnostic-log exfiltration channel. Any installer whose code runs console.warn/console.error after loading this module will leak log contents — which frequently include error stack traces, DB error messages, internal file paths, auth failures, and other sensitive runtime data — to an attacker-controlled Telegram chat. Additional unreachable files (t.js, o.js, jq.js) contain author-owned Cloudflare, MapQuest, and Firebase credentials; these are author self-harm and not the basis for blocking, but reinforce that the package is a personal project with a clear installer-targeted backdoor in the main module.

    References: https://www.npmjs.com/package/88q/v/1.1.1, https://www.npmjs.com/package/88q/v/1.4.8, https://www.npmjs.com/package/88q/v/1.2.6, https://www.npmjs.com/package/88q/v/1.3.6, https://www.npmjs.com/package/88q/v/1.0.2, https://www.npmjs.com/package/88q/v/1.2.4, https://www.npmjs.com/package/88q/v/1.4.9, https://www.npmjs.com/package/88q/v/1.1.4, https://www.npmjs.com/package/88q/v/1.4.6, https://www.npmjs.com/package/88q/v/1.3.3, https://www.npmjs.com/package/88q/v/1.0.7, https://www.npmjs.com/package/88q/v/1.3.5, https://www.npmjs.com/package/88q/v/1.2.3, https://www.npmjs.com/package/88q/v/1.2.5, https://www.npmjs.com/package/88q/v/1.4.7, https://www.npmjs.com/package/88q/v/1.2.7, https://www.npmjs.com/package/88q/v/1.3.2, https://www.npmjs.com/package/88q/v/1.1.5

    Affected packages

    Package

    Name: 88q

    Purl: pkg:npm/88q

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.1
    1.1.4
    1.1.5