MAL-2026-4816

    Dashboard / Malicious Package / MAL-2026-4816

    MAL-2026-4816

    Published: 26 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in amaco-os (npm)

    Details: Source: amazon-inspector (0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506) dist/index.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) referenced from a fetch/POST call alongside process.env access. The pattern — fetch() + POST + api.telegram.org + process.env — is the canonical Telegram-bot exfiltration channel used to ship installer-side environment variables (and other host data) to an attacker-controlled bot/chat. Telegram's Bot API serves as a hardcoded C2: the attacker only needs the bot token embedded in the bundle to receive every installer's data. There is no legitimate reason for an OS-themed package's bundle to POST to the Telegram Bot API while reading process.env.

    References: https://www.npmjs.com/package/amaco-os/v/0.1.0, https://www.npmjs.com/package/amaco-os/v/0.1.1

    Affected packages

    Package

    Name: amaco-os

    Purl: pkg:npm/amaco-os

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.0
    0.1.1
    MAL-2026-4816 | CVE-DB