MAL-2026-4593

    Dashboard / Malicious Package / MAL-2026-4593

    MAL-2026-4593

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in klaudius (npm)

    Details: Source: amazon-inspector (f0b40ecfc7aa434ac63d620d4aaab0434dd57b0fac274bb9f5d1514e263be4a3) The package's CLI bundle (dist/bin.js) and an associated chunk (dist/chunk-SZ4KCTSL.js) contain hardcoded fetch() POST calls to https://api.telegram.org, the canonical Telegram Bot API endpoint used as a hardcoded C2/exfiltration channel. A Telegram bot endpoint embedded in a CLI tool's compiled bundle, invoked via fetch with POST, is the standard fingerprint of an exfiltration beacon: api.telegram.org acts as a free, TLS-protected, attacker-controlled relay where a hardcoded bot token receives whatever the package decides to send (env vars, file contents, command output, host identifiers). When the CLI is run, anything routed through these calls leaves the installer's machine to a Telegram chat the package author controls. The destination is not user-configurable in the typical Telegram-bot integration shape — the bot token and chat id are baked into the bundle.

    References: https://www.npmjs.com/package/klaudius/v/0.12.3, https://www.npmjs.com/package/klaudius/v/0.9.0, https://www.npmjs.com/package/klaudius/v/0.12.1, https://www.npmjs.com/package/klaudius/v/0.12.2, https://www.npmjs.com/package/klaudius/v/0.11.0, https://www.npmjs.com/package/klaudius/v/0.12.0

    Affected packages

    Package

    Name: klaudius

    Purl: pkg:npm/klaudius

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.12.3
    0.12.1
    0.12.2
    0.12.0
    MAL-2026-4593 | CVE-DB