@siriusbeyond/utils@99.0.0
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16322
Ecosystem
npm
Summary
Package @siriusbeyond/utils@99.0.0 declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance (hostname, username, platform, cwd, home directory, UID, CI/cloud fingerprints) and enumerates process.env keys matching credential regexes (/token/i, /secret/i, /key/i, /password/i, /auth/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i, /registry/i, /artifactory/i, /nexus/i, /credential/i), taking up to 20 matches, and POSTs the collected payload via https.request to api.telegram.org /bot<token>/sendMessage using a hardcoded Telegram bot token (8605555117) and chat id (1064260758). The version number 99.0.0 and the exfiltration behavior are consistent with a dependency-confusion attack against an internal @siriusbeyond scope. The activity fires automatically on default npm install with no user action.
Source: amazon-inspector (330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.