claude-channel-telegram

{"modified":"2026-08-31T18:03:55Z","published":"2026-08-31T18:03:55Z","schema_version":"1.7.4","id":"MAL-2026-15624","summary":"Malicious code in claude-channel-telegram (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7715d12c1677dbf8b8ba4747cced0f41211f3be783d159685b9108d312d586f1)\nclaude-channel-telegram@9.9.9 is a dependency-confusion lure with no functional code. package.json wires both preinstall and postinstall lifecycle hooks to run index.js, which reads os.hostname() and issues an HTTPS request to https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-telegram?h=<hostname>, sending the installing machine's hostname to an attacker-controlled Pipedream webhook on every npm install. The package name evokes an Anthropic Claude / Telegram integration and the version is pinned implausibly high (9.9.9) to win resolution against an internal package of the same name. package.json also declares the package as its own dependency and lists `requests` (a typosquat of `request`), consistent with a namespace-squat payload rather than a real library.\n","affected":[{"package":{"ecosystem":"npm","name":"claude-channel-telegram"},"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ebd05f905f2f02d306de4a60a69ccf3511b7e4a3d71596d9f45e71ad51abdec4","tlsh":"43d0a7c30bd8722471809981d6921a076317f10672b88174904d82d69dd2ce00833ce0"},{"path":"package.json","sha256":"e3e149a5e44ad88172ac18d8baf068085e6ea61881b8fcb3a1394cdb960e2987","tlsh":"f4f0a791cd505b7310f832f95ab5260bb151af2b511c5c0b34f7b08d66a2562449ef29"}],"package_integrity":[{"filename":"claude-channel-telegram-9.9.9.tgz","hashes":{"sha1":"b0338df6986d00bf6a6d49afab17d0cb2daa0db2","sha512_sri":"sha512-070n10FbV2sF5Pm8F+VggdJgYWILDkdYOvFLa2TtjWy9qYIFsAF9/qBrkDiRFw7Bcqo+YDbnd35mY1ViIMgUaA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/claude-channel-telegram/v/9.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019315","import_time":"2026-08-31T18:22:30.062401934Z","modified_time":"2026-08-31T18:03:55Z","sha256":"7715d12c1677dbf8b8ba4747cced0f41211f3be783d159685b9108d312d586f1","source":"amazon-inspector","versions":["9.9.9"]}]}}