{"id":"MAL-2026-4395","summary":"Malicious code in @inetafrica/open-claudia (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1d2fde4b2f69d2aa99c4fcc7ed5b04bd029394caf40067eb2be6987bf30a1b03)\nThe package ships multiple modules (health.js, setup.js, bot.js, core/media.js, core/handlers.js) that combine child_process, fs, and https to build and POST payloads to hardcoded network destinations, including https://api.telegram.org. health.js at line 95 issues https.get against api.telegram.org and reads process.env, process.platform, and process.version alongside filesystem probes. setup.js at lines 79/92/95 makes https.get/https.request/POST calls to api.telegram.org while reading process.env at lines 317/362 and platform info at line 156, and also references huggingface.co at line 259. bot.js at line 18 pulls in child_process and at lines 166/184/185/217 performs POST/https.get operations while enumerating the filesystem (fs.existsSync, fs.readdirSync at lines 143-144) and reading process.env at lines 96/179. core/scheduler.js at line 128 spawns a shell (\"sh\"). core/handlers.js at line 614 POSTs after invoking whoami (lines 373, 473) and hostname (line 615). The recurring pattern across these files is: read installer-side identity/environment data (process.env, hostname, whoami, filesystem contents), then transmit it to a hardcoded Telegram Bot API endpoint that is not configured by the caller. Telegram Bot API is a documented exfiltration channel in supply-chain attacks because the destination host is neutral infrastructure and the bot token embedded in the code selects the attacker-controlled recipient chat.\n","modified":"2026-08-06T15:34:46.307987481Z","published":"2026-05-22T09:30:38Z","withdrawn":"2026-05-26T18:04:02Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-22T09:30:38Z","sha256":"09b3881ec598069649e57612f04359886ef22331899541885248ea6a0a41bce2","source":"amazon-inspector","versions":["2.2.15"],"id":"IN-MAL-2026-004177","import_time":"2026-05-26T05:52:05.215343928Z"},{"source":"amazon-inspector","versions":["2.2.16"],"id":"IN-MAL-2026-004474","import_time":"2026-05-26T05:52:40.282374032Z","modified_time":"2026-05-24T09:16:41Z","sha256":"766e927208a79fafba984ef22edef82ea87cdb9c520c5e9cbaa9e63fd47be70e"},{"import_time":"2026-08-06T15:19:32.608383561Z","modified_time":"2026-08-06T14:21:00Z","sha256":"17430fece467aa5f1acf023682c9836f917e32b3f8dc652aff9b8dcd37f745d3","source":"amazon-inspector","versions":["3.1.16"],"id":"IN-MAL-2026-016608"},{"modified_time":"2026-08-06T14:22:13Z","sha256":"1a939f70dcc88e7b0e80fcecc3eef83786c5717c133cffd1da1af8e6a7fb42eb","source":"amazon-inspector","versions":["3.1.21"],"id":"IN-MAL-2026-016616","import_time":"2026-08-06T15:19:33.232623367Z"},{"sha256":"28327cc6a3a280a3d26c67d6901c80380938f713c20dd1fb2d5cfc7e131969aa","source":"amazon-inspector","versions":["3.1.24"],"id":"IN-MAL-2026-016603","import_time":"2026-08-06T15:19:32.328619977Z","modified_time":"2026-08-06T14:20:13Z"},{"modified_time":"2026-08-06T14:22:44Z","sha256":"2b64b3b8eb3f6fb672ae7bf27e958fdfe0d3c0669be7dd3bb7a626f159b7765c","source":"amazon-inspector","versions":["3.1.7"],"id":"IN-MAL-2026-016620","import_time":"2026-08-06T15:19:33.482878435Z"},{"versions":["3.0.35"],"id":"IN-MAL-2026-016615","import_time":"2026-08-06T15:19:33.163671508Z","modified_time":"2026-08-06T14:21:58Z","sha256":"523fd8f6cad83c8df6dbb7d9fda547714a289d8f8710c281d6947d94aebe0d09","source":"amazon-inspector"},{"import_time":"2026-08-06T15:19:33.118566613Z","modified_time":"2026-08-06T14:21:51Z","sha256":"a848cf77afff956e5fd6300d61393940fba9181c509b2ee1b2b72e8028f29842","source":"amazon-inspector","versions":["3.1.13"],"id":"IN-MAL-2026-016614"},{"import_time":"2026-08-06T15:19:32.519376227Z","modified_time":"2026-08-06T14:20:41Z","sha256":"de9795e8644235fbeb4ad50e17823eb7b68b6ac1a6ea299b8c9d51b771563632","source":"amazon-inspector","versions":["3.1.17"],"id":"IN-MAL-2026-016606"},{"sha256":"ed83f7ae0e77ccef701306cfb53a0d0d12093cefa8b94f7d6d4c93577c4ed585","source":"amazon-inspector","versions":["3.1.14"],"id":"IN-MAL-2026-016605","import_time":"2026-08-06T15:19:32.453851088Z","modified_time":"2026-08-06T14:20:30Z"},{"import_time":"2026-08-06T15:19:33.002850603Z","modified_time":"2026-08-06T14:21:41Z","sha256":"63b0cc86cf0332c9976c6a6392e1760cfb56c91eae6c41e7c9f1716526f871a3","source":"amazon-inspector","versions":["3.1.27"],"id":"IN-MAL-2026-016613"},{"versions":["3.1.23"],"id":"IN-MAL-2026-016602","import_time":"2026-08-06T15:19:32.287920766Z","modified_time":"2026-08-06T14:20:05Z","sha256":"d218226a38e557f4d0af2b28c153495239d6bddb8fd9b39c8003e8925e948573","source":"amazon-inspector"},{"id":"IN-MAL-2026-016612","import_time":"2026-08-06T15:19:32.873381952Z","modified_time":"2026-08-06T14:21:33Z","sha256":"e30c3f7eaf5dac32ffb90a2f361393536ca0949c0efd01100fde788f6416fc2d","source":"amazon-inspector","versions":["3.1.4"]},{"source":"amazon-inspector","versions":["3.1.26"],"id":"IN-MAL-2026-016618","import_time":"2026-08-06T15:19:33.375803272Z","modified_time":"2026-08-06T14:22:28Z","sha256":"13aad10d2600f9b0b64d61cbb52a61dcff4eccec01c0ade268cbb6ecd30d3078"},{"source":"amazon-inspector","versions":["3.1.3"],"id":"IN-MAL-2026-016617","import_time":"2026-08-06T15:19:33.296793886Z","modified_time":"2026-08-06T14:22:20Z","sha256":"1d2fde4b2f69d2aa99c4fcc7ed5b04bd029394caf40067eb2be6987bf30a1b03"},{"sha256":"5f001db733ff6b8707fb5ecb172ca1f43f155eb0c323d5af6738488e40477106","source":"amazon-inspector","versions":["3.0.43"],"id":"IN-MAL-2026-016607","import_time":"2026-08-06T15:19:32.575810114Z","modified_time":"2026-08-06T14:20:51Z"},{"id":"IN-MAL-2026-016610","import_time":"2026-08-06T15:19:32.721334127Z","modified_time":"2026-08-06T14:21:17Z","sha256":"74d3c31956687b6ce17e1fba19b9fce658256b1fe77c6e2ef9d3fc9fa1de7c82","source":"amazon-inspector","versions":["3.1.25"]},{"modified_time":"2026-08-06T14:21:25Z","sha256":"aa2a2118fb019661aaa00dc0da79d99ae27e1796a9fb3c4c0ed7b128fad99540","source":"amazon-inspector","versions":["3.1.22"],"id":"IN-MAL-2026-016611","import_time":"2026-08-06T15:19:32.797523853Z"},{"versions":["3.2.0"],"id":"IN-MAL-2026-016619","import_time":"2026-08-06T15:19:33.42181971Z","modified_time":"2026-08-06T14:22:36Z","sha256":"c0b999b117766264f9802d91fa0af7c1112e0641821254bd72062a041725316a","source":"amazon-inspector"},{"id":"IN-MAL-2026-016609","import_time":"2026-08-06T15:19:32.656879326Z","modified_time":"2026-08-06T14:21:07Z","sha256":"3c7d8872721b32229715234c263d28ace5a2e88ea7212aafe0a587df7e68620f","source":"amazon-inspector","versions":["3.1.28"]},{"import_time":"2026-08-06T15:19:32.37506554Z","modified_time":"2026-08-06T14:20:20Z","sha256":"889d907305a04d6ef03fdf838789c927a101f3956dee9a10523a5979666fe66e","source":"amazon-inspector","versions":["3.0.34"],"id":"IN-MAL-2026-016604"},{"id":"IN-MAL-2026-016601","import_time":"2026-08-06T15:19:32.254085768Z","modified_time":"2026-08-06T14:19:57Z","sha256":"ed4180eea0f57cfa56162c91bb6ff60d4bf03b55136b22f4453e881ec13a558d","source":"amazon-inspector","versions":["3.1.12"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/2.2.15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/2.2.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.24"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.35"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.17"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.43"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.25"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.0.34"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@inetafrica/open-claudia/v/3.1.12"}],"affected":[{"package":{"name":"@inetafrica/open-claudia","ecosystem":"npm","purl":"pkg:npm/%40inetafrica/open-claudia"},"versions":["2.2.15","2.2.16","3.1.16","3.1.21","3.1.24","3.1.7","3.0.35","3.1.13","3.1.17","3.1.14","3.1.27","3.1.23","3.1.4","3.1.26","3.1.3","3.0.43","3.1.25","3.1.22","3.2.0","3.1.28","3.0.34","3.1.12"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"0232a745dafe297247b7926a170b20237b55d6133204cc64b6ece3a6bf85094d2f39ec","path":"bin/cli.js","sha256":"d889293dcda5793c428ba196ef5a058ab5a2436f953b537e5e86e5e4ffafe72c"},{"sha256":"6b3c9b7184f6b394b1e5a49972d0caaa86165d13d8c5c803a79f78180abf874e","tlsh":"d493f93560fb653176a2e06da31b602b7b3ab1173204e5a4b59cb6442fdd168c1f3bbc","path":"bot-agent.js"},{"path":"bot.js","sha256":"f54f63c6037b7a6ca3dd3eb4bc2e333c3d65982ffe97676a41f642316627c9e6","tlsh":"13f1b7761afa01327473d28e8a0b501679a7f5073308c9d4765df26a1fce46487b6bf8"},{"sha256":"a99a80da9ec7d66d135b3a97bcab1685ab798bba120436f48f4494a916882c1d","tlsh":"ec53f8a460bb903169f7f15e5b1b1117372aa3173218d494b95ce3082fee159c2befe8","path":"core/handlers.js"},{"tlsh":"91a2778639a2b022db772128969bec16b36ef947784dc894b78c4650ffd30649376fc4","path":"core/loopback.js","sha256":"b3584055d8e9b758020ae95531db7fbb1281bae9a61ed1d8897fd5e61f584928"},{"sha256":"79a2d267b44f8a417e759c1dd423abf2064922bb51687046fdfaeb16a92525ef","tlsh":"3d72668e0de673359ba1a2696b0b60227365b143220cfd54f6dd92703f5d03452fbbea","path":"health.js"},{"sha256":"8aee04e520de5b1b33682fc842748b693feec976c4787d919ade56cdfdb98e9a","tlsh":"55d2a3754afa5134757ae06d974b501632a4b5173209ec6433dcb3a91fee82880bbefc","path":"setup.js"},{"path":"web.js","sha256":"8cebe8c91daac4c4a7e218e85cb9ac4101be297f3771a9327a65d0bf6c7e0ed5","tlsh":"bbe2c6b220e7092733a6d16c4657821a7761f517f00a8e60faac71982fdf865c1b79f8"}],"package_integrity":[{"filename":"open-claudia-2.2.15.tgz","hashes":{"sha1":"d71e44dde5fcf517ab243d1ec0154be4a5d84b0e","sha512_sri":"sha512-rau9m7jfP9l/YZCjoSYmUFjiBtc103qeI7sfR0QWPHMNhEeQA3+1mLWDd0aCpQrFnHCLqnRILKTGGo0l9JnDAA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@inetafrica/open-claudia/MAL-2026-4395.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}