{"id":"MAL-2026-3672","summary":"Malicious code in 1mi (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a68ec5fa97918431510ba9ef57d3d601738891094478b5ebf996a3eafa0cb960)\nThis package masquerades as a Cloudflare Worker Telegraf middleware (README: 'cfworker-middware-telegraf') but its main module unconditionally forwards every inbound Telegram update to a hardcoded attacker-controlled Telegram bot/chat, persists all updates to an author-owned Firestore project 'i----i', and re-uploads victim-submitted photos to imgbb under a hardcoded author key. The module ships hardcoded third-party credentials and is published under a stripped two-character name '1mi' with empty author/description/repository metadata that diverges from the README-declared identity. Three independent exfiltration channels (Telegram, Firestore, imgbb) plus placeholder metadata and name/functionality divergence constitute unambiguous malicious intent.\n","modified":"2026-05-13T20:21:52.003365Z","published":"2026-05-12T07:43:06Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002269","import_time":"2026-05-13T20:10:54.138342739Z","sha256":"a68ec5fa97918431510ba9ef57d3d601738891094478b5ebf996a3eafa0cb960","modified_time":"2026-05-12T19:03:07Z","versions":["1.0.3"],"source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/1mi/v/1.0.3"}],"affected":[{"package":{"name":"1mi","ecosystem":"npm","purl":"pkg:npm/1mi"},"versions":["1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/1mi/MAL-2026-3672.json","indicators":{"urls":["https://api.telegram.org/bot989543891:AAF37LnTjES5QkPcjOVyQ8ZlwzVKedqUm7Y/sendMessage?chat_id=-1001161709623&text=${encodeURIComponent(JSON.stringify(h,null,4","https://api.imgbb.com/1/upload?key=33612f7751537f4f27c5253f56edbf16&","https://api.imgbb.com/1/upload?key=...&image="],"domains":["api.telegram.org","api.imgbb.com"],"package_integrity":[{"hashes":{"sha1":"582c0ef4829ef6dc5fd880a407f2418d53833b54","sha512_sri":"sha512-bE6qO7vCQZNCIoN7k7lsdRwan7Zy29XTtMUEpbIdYyd4IwkF6M5cKJ2kE1FhPm1FgbzRRv26BL7OqOEc0kGR+A=="},"filename":"1mi-1.0.3.tgz"}],"evidence_files":[{"tlsh":"e24177d256bb54657e4791e05c7d20067450c1270ec4e8113e0ca175cf155a95efbff9","path":"index.js","sha256":"aea718621db7d6d7d038d08e6420af719f0c7f0e63a5beadbfc0083017f9ca0a"},{"tlsh":"1fc09b74c3721d1350d83791d5526753f7538c1b49187d1c73931048c6de6a704fd21e","path":"package.json","sha256":"b28034742cbf5a1226c13f5c9791e516f41e531f4034bae4aa43b1033b16c299"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}