@siriusbeyond/utils

{"modified":"2026-09-21T03:28:40Z","published":"2026-09-21T03:28:40Z","schema_version":"1.7.4","id":"MAL-2026-16322","summary":"Malicious code in @siriusbeyond/utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689)\nPackage @siriusbeyond/utils@99.0.0 declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance (hostname, username, platform, cwd, home directory, UID, CI/cloud fingerprints) and enumerates process.env keys matching credential regexes (/token/i, /secret/i, /key/i, /password/i, /auth/i, /aws/i, /azure/i, /npm/i, /git/i, /docker/i, /registry/i, /artifactory/i, /nexus/i, /credential/i), taking up to 20 matches, and POSTs the collected payload via https.request to api.telegram.org /bot<token>/sendMessage using a hardcoded Telegram bot token (8605555117) and chat id (1064260758). The version number 99.0.0 and the exfiltration behavior are consistent with a dependency-confusion attack against an internal @siriusbeyond scope. The activity fires automatically on default npm install with no user action.\n","affected":[{"package":{"ecosystem":"npm","name":"@siriusbeyond/utils"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"92acd9d29ba169e07719394d8c8a097a29cd548d4fa5f3afa38a9c953675e90d","tlsh":"ca71e7c852ebd5221be116d76559bc036946e0073f0db1623a1c53906fc896d87727ff"}],"package_integrity":[{"filename":"utils-99.0.0.tgz","hashes":{"sha1":"a65bc3c27b2b7f24d377877b7cdeb7fc370f6865","sha512_sri":"sha512-ExeBiTo/IDnc/LxjH6nOW5cXaaHtAvGJEIEwWicMj4+uATT3b/JQcK/FSiajRkZXb9Jy9rc+3VYfBPztgMy/FQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@siriusbeyond/utils/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020217","import_time":"2026-09-21T03:46:36.799604515Z","modified_time":"2026-09-21T03:28:40Z","sha256":"330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689","source":"amazon-inspector","versions":["99.0.0"]}]}}