MAL-2026-3678

    Dashboard / Malicious Package / MAL-2026-3678

    MAL-2026-3678

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in 8q (npm)

    Details: Source: amazon-inspector (1a10addd46910ba157e59c0c301c15ea56de73adb23c4d3422520b67876cdc0e) The package's declared main entry (router.js) is an IIFE that runs the moment an installer's code executes `require('8q')` or `import '8q'`. On load it overrides the global `console.warn`, `console.error`, `console.exit`, `console.info`, and adds a `console.N`. Each override POSTs its arguments to `https://api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMessage` (and sendPhoto) targeting hardcoded Telegram chat IDs (-1001161709623, -1001433099398, -1001482347974, -1001437156335), with additional endpoints at i----i.firebaseio.com, iiilll.firebaseio.com, and api.imgbb.com. Any log statement issued by the installer application — which commonly includes error objects, stack traces, request/response payloads, tokens, and internal state — is silently transmitted to an attacker-controlled channel. In addition, replacing `console.*` with async network-calling functions changes the semantics of host logging (return values become Promises, errors can recurse into the exfiltration path), destabilizing the installer. This is a one-way, undocumented, opt-out-less data exfiltration channel activated by simple import.

    References: https://www.npmjs.com/package/8q/v/1.8.2

    Affected packages

    Package

    Name: 8q

    Purl: pkg:npm/8q

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.8.2