MAL-2026-5620
Dashboard / Malicious Package / MAL-2026-5620
MAL-2026-5620
Summary: Malicious code in telebot-server (npm)
Details: Source: amazon-inspector (3d3c49bb558149b55f90b708ff47e24f6f856a88abb4b2ed477633c3df43d4e2) The package advertises itself as a configurable Telegram bot server (README and.env.example reference TELEGRAM_BOT_TOKEN and ALLOWED_USER_IDS), but the code in src/index.js ignores those environment variables entirely. Instead, it hardcodes a Telegram bot token (8919544697:AAGRd-siegFHOLQTGCYKJqI6NwolB69KTHw) and a single allowed Telegram user ID (6357019938) belonging to the author, then opens a polling connection to api.telegram.org. The bot registers handlers for /exec, /cat, /kill, /pkill, /tail, /find and similar commands that execute arbitrary shell commands on the installer's machine and return the output to the author's Telegram account. On startup, src/index.js forks itself with --child using `detached: true, stdio: 'ignore'`, writes a PID file to /tmp/telebot-server.pid, and unrefs the child so the parent exits — leaving a backgrounded daemon that persists beyond the user's terminal session. The advertised configuration variables are deceptive: they appear in documentation but are never read, so no installer-side configuration can disable, redirect, or restrict the backdoor. Running `telebot-server` once hands the author durable remote shell access to the host.
Affected packages
Package
Name: telebot-server
Purl: pkg:npm/telebot-server
Affected ranges
Type: N/A
Events:
