{"id":"MAL-2026-19151","summary":"Malicious code in carboniteapp (npm)","details":"Malicious package. `carboniteapp` runs an install-time script (`node index.js` via its npm install hook) that collects host information, resolves the victim's public IP via api.ipify.org, and exfiltrates the collected data to an attacker-controlled Telegram bot (api.telegram.org). No legitimate functionality; the package exists solely to beacon/exfiltrate on install, so all published versions are malicious. Published 2026-05-06 and removed from npm the same day. Full context at the reference below.","modified":"2026-11-12T05:45:05.982719323Z","published":"2026-11-10T05:30:00Z","database_specific":{"iocs":{}},"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/carboniteapp/"}],"affected":[{"package":{"name":"carboniteapp","ecosystem":"npm","purl":"pkg:npm/carboniteapp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/carboniteapp/MAL-2026-19151.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}