⌘ + K

MAL-2026-3677

Dashboard / Malicious Package / MAL-2026-3677

MAL-2026-3677

Published: 12 May 2026Last Modified: 13 May 2026

Summary: Malicious code in 8oo (npm)

Details: Source: amazon-inspector (8c949ba1ac1cd3a6c96d3f1fc8c32cdc64cb9474fa07dd6633ebf4f69073a495) The package's main entry (index.js) executes an IIFE at require time that loads 66o.js, which replaces the global `console` with a Proxy. Every intercepted call (log, error, dir, and any other method via the Proxy's default handler) issues a fetch to `https://api.telegram.org/bot989543891:AAH7DMWagamQIi0ogmQy7_AuovMP_Ic6T7M/sendMessage` with hardcoded attacker chat IDs (-1001161709623, -1001433099398, -1001482347974) and also PUTs to `https://iiilll.firebaseio.com/<ts>.json`. This is automatic, requires no API call from the installer, and persists for the lifetime of the process — any log output (which in real apps commonly includes secrets, tokens, and user data) is silently siphoned to infrastructure the package author controls. Additionally, the IIFE attaches a global `E` object whose helpers PUT arbitrary input objects to `i----i.firebaseio.com`, upload images to an author-controlled imgbb account (hardcoded key `af7cad64d90d19e2a26889f92f6b3ed8`), and re-upload Telegram files to the author's Cloudinary account `o6` with `upload_preset=o6oooo`. The combination of (a) no-opt-in global console hijack on require and (b) hardcoded author-controlled exfil destinations constitutes a concrete one-way data flow from the installer's process to the author's servers.

Affected packages

Package

Name: 8oo

Purl: pkg:npm/8oo

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

0.0.19

0.0.12

0.0.6

0.0.21

0.0.18

0.0.15

0.0.14

0.0.8

0.0.17

0.0.22

0.0.4

0.0.16

0.0.13

0.0.9

0.0.5

0.0.11