MAL-2026-4395

Dashboard / Malicious Package / MAL-2026-4395

MAL-2026-4395

Summary: Malicious code in @inetafrica/open-claudia (npm)

Details: Source: amazon-inspector (1d2fde4b2f69d2aa99c4fcc7ed5b04bd029394caf40067eb2be6987bf30a1b03) The package ships multiple modules (health.js, setup.js, bot.js, core/media.js, core/handlers.js) that combine child_process, fs, and https to build and POST payloads to hardcoded network destinations, including https://api.telegram.org. health.js at line 95 issues https.get against api.telegram.org and reads process.env, process.platform, and process.version alongside filesystem probes. setup.js at lines 79/92/95 makes https.get/https.request/POST calls to api.telegram.org while reading process.env at lines 317/362 and platform info at line 156, and also references huggingface.co at line 259. bot.js at line 18 pulls in child_process and at lines 166/184/185/217 performs POST/https.get operations while enumerating the filesystem (fs.existsSync, fs.readdirSync at lines 143-144) and reading process.env at lines 96/179. core/scheduler.js at line 128 spawns a shell ("sh"). core/handlers.js at line 614 POSTs after invoking whoami (lines 373, 473) and hostname (line 615). The recurring pattern across these files is: read installer-side identity/environment data (process.env, hostname, whoami, filesystem contents), then transmit it to a hardcoded Telegram Bot API endpoint that is not configured by the caller. Telegram Bot API is a documented exfiltration channel in supply-chain attacks because the destination host is neutral infrastructure and the bot token embedded in the code selects the attacker-controlled recipient chat.

References: https://www.npmjs.com/package/@inetafrica/open-claudia/v/2.2.15, https://www.npmjs.com/package/@inetafrica/open-claudia/v/2.2.16, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.16, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.21, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.24, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.7, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.35, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.13, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.17, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.14, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.27, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.23, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.4, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.26, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.3, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.43, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.25, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.22, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.2.0, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.28, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.34, https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.12