@siriusbeyond/auth

{"schema_version":"1.7.4","id":"MAL-2026-16320","published":"2026-09-20T09:35:26Z","modified":"2026-09-21T05:20:58.869171493Z","summary":"Malicious code in @siriusbeyond/auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695)\nPackage @siriusbeyond/auth@99.0.0 registers both preinstall and postinstall lifecycle scripts that execute callback.js on every `npm install`. callback.js collects installer host identifiers (hostname, username, platform, cwd, homedir, CI/cloud indicators, npm registry) together with a filtered list of environment variable names matching token/secret/key/password/aws/npm/git patterns, and POSTs a Markdown report to https://api.telegram.org/bot<token>/sendMessage using a hardcoded bot token and chat_id 1064260758 embedded in the source. The lifecycle commands are wrapped in `2>/dev/null || true` to suppress errors and hide the beacon from install output. The version number 99.0.0 and private-scope name are the standard dependency-confusion shape targeting the `@siriusbeyond` scope, causing internal builds that reference that scope to resolve to this public package and beacon out. The package's self-description as a 'Dependency Confusion PoC / security research' does not change the runtime behavior: installer-owned data leaves every machine that installs it to an author-controlled Telegram channel.\n\n## Source: ossf-package-analysis (1d6b359a24803199b8b8cbc77aed1c8ceac0706a76db4ec00a9964bf1f8b1e37)\nThe OpenSSF Package Analysis project identified '@siriusbeyond/auth' @ 99.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@siriusbeyond/auth","ecosystem":"npm"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"92acd9d29ba169e07719394d8c8a097a29cd548d4fa5f3afa38a9c953675e90d","tlsh":"ca71e7c852ebd5221be116d76559bc036946e0073f0db1623a1c53906fc896d87727ff"},{"path":"package.json","sha256":"ac241aed2e1089295fe50cbd411761607313c4c0467f769a750333428525f656","tlsh":"2ee0f1645e080b233de8ced93435c70190395d1f0cac782513b3498491ce7624a7d3bf"}],"package_integrity":[{"filename":"auth-99.0.0.tgz","hashes":{"sha1":"bf75d87a70558f6e77d9e7cd483e50db21a5c41c","sha512_sri":"sha512-ZKKt9ZCcPED5I9Fg1FCpN90rfpjbh6BtwL4zfe+pKfTGYWizWSHh0nnontNICGVd1c6uVAKsNcyXvL9axo4hfw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@siriusbeyond/auth/v/99.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020219","import_time":"2026-09-21T03:46:36.974080125Z","modified_time":"2026-09-21T03:29:00Z","sha256":"4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695","source":"amazon-inspector","versions":["99.0.0"]},{"import_time":"2026-09-21T05:19:22.137498381Z","modified_time":"2026-09-20T09:35:26Z","sha256":"1d6b359a24803199b8b8cbc77aed1c8ceac0706a76db4ec00a9964bf1f8b1e37","source":"ossf-package-analysis","versions":["99.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}