bt2-api-gateway-node-js

{"schema_version":"1.7.4","id":"MAL-2026-15813","published":"2026-09-01T17:16:24Z","modified":"2026-09-03T06:32:12.233236423Z","summary":"Malicious code in bt2-api-gateway-node-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b)\nbt2-api-gateway-node-js@999.0.1 runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens — and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot<token>/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5–15 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal 'bt2-api-gateway' package.\n\n## Source: ossf-package-analysis (e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e)\nThe OpenSSF Package Analysis project identified 'bt2-api-gateway-node-js' @ 999.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"bt2-api-gateway-node-js","ecosystem":"npm"},"versions":["999.0.1","999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b8c840cabee2ef2ab6178fee79af1df16827c47c486f9a173c532712c292f6be","tlsh":"1b12339b15fb35598223f27adf5f8017212eada36106dd443a0c89d01f4c66cdba1f9c"}],"package_integrity":[{"filename":"bt2-api-gateway-node-js-999.0.1.tgz","hashes":{"sha1":"93c33d4fe45b7be2550c6826368c1792257e07a4","sha512_sri":"sha512-7id6Y1Cq4D6jtoUq7BtAJ5hgEQO1zIAKseCSIG+7ZfG7aYEIWKl4TnFMeOd/igVYIhOqogrjGbGHGQ9zRvNh1A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019324","import_time":"2026-09-02T04:23:32.995602482Z","modified_time":"2026-09-02T03:57:07Z","sha256":"1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b","source":"amazon-inspector","versions":["999.0.1"]},{"id":"IN-MAL-2026-019326","import_time":"2026-09-02T04:23:33.214039025Z","modified_time":"2026-09-02T03:57:23Z","sha256":"dc93cb460e7ec59d420f549dbd0180b89198e4c14228cc6f71b9ee2826a737cd","source":"amazon-inspector","versions":["999.0.0"]},{"import_time":"2026-09-03T06:30:16.971559625Z","modified_time":"2026-09-01T17:16:24Z","sha256":"e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e","source":"ossf-package-analysis","versions":["999.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}