MAL-2026-4518
Dashboard / Malicious Package / MAL-2026-4518
MAL-2026-4518
Summary: Malicious code in cheaty-sync-bot (npm)
Details: Source: amazon-inspector (45b192c71c59ccca1d9cc720372bd29f39eae8b5da4d572cd1e8312d6b57d6b4) cheaty-sync-bot ships a clipboard-sync CLI that hardcodes a single Telegram bot token (index.js:10) owned by the package author. There is no configuration path for installers to supply their own bot — every user of this tool connects to the same author-controlled relay. Two concrete harms result: (1) Silent-relay: clipboard contents (text and images) and installer chat identifiers flow through the author's Telegram bot, giving the author visibility into every installer's session via getUpdates polling. (2) Backdoor / remote code execution: incoming Telegram messages are interpolated into a PowerShell command (`powershell -Command "Set-Clipboard -Value \"${escapedText}\""`) at index.js:31-34 and passed to `exec()`. The escaping only replaces double quotes with backtick-quotes; PowerShell metacharacters such as backticks, `$(...)` subexpressions, and newlines are not sanitized, so anyone holding the bot token (the author, or anyone who obtains it) can send a crafted message to any installer running the CLI and achieve arbitrary command execution on the Windows host.
Affected packages
Package
Name: cheaty-sync-bot
Purl: pkg:npm/cheaty-sync-bot
Affected ranges
Type: N/A
Events:
