{"id":"MAL-2026-4552","summary":"Malicious code in etherproxy-lite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5756836b470f645f316696cbaedb1aedc21cde7fc921714bfbf70f2d528ad5b4)\nThe bundled dist/index.js reads process.env values and posts data to https://api.telegram.org via a hardcoded fetch call (line 97), with additional POST/fetch primitives at lines 63, 69, and 98. The Telegram bot API endpoint pattern (api.telegram.org/bot\u003ctoken\u003e/sendMessage) is a well-documented exfiltration channel used to deliver harvested credentials and host data to an attacker-controlled bot, leveraging Telegram's TLS infrastructure to defeat domain blocking. Combined with the require(\"fs\") + require(\"http\") + process.env reads in the same module, the package's behavior is environment harvesting and outbound exfiltration on use. Installing or loading this package routes installer-side environment variables to an attacker-controlled Telegram bot.\n","modified":"2026-05-27T00:32:12.928902735Z","published":"2026-05-25T20:30:38Z","withdrawn":"2026-05-26T18:39:44Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-25T20:30:38Z","sha256":"5756836b470f645f316696cbaedb1aedc21cde7fc921714bfbf70f2d528ad5b4","source":"amazon-inspector","versions":["0.6.0"],"id":"IN-MAL-2026-004774","import_time":"2026-05-26T05:53:15.405599672Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/etherproxy-lite/v/0.6.0"}],"affected":[{"package":{"name":"etherproxy-lite","ecosystem":"npm","purl":"pkg:npm/etherproxy-lite"},"versions":["0.6.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/etherproxy-lite/MAL-2026-4552.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"e2925e7f33601556ea6ddc85e61bccf598e104b64ee779ab0f3677d91e19dd57","tlsh":"a79153451ff380f221f3116bb65756022a56e12336aedde47bcc97ae1f81a548b603cd"}],"package_integrity":[{"filename":"etherproxy-lite-0.6.0.tgz","hashes":{"sha1":"3b757caf88719e144bb4a49f44f69f0c864ba628","sha512_sri":"sha512-Uusjn+Clj5DV0PXfxDhfyMFueFDEloQ2fUZY0w8f9JDpkKa6EXBrnwQoJnzXeZ0IDQZwXJUSlJIBCPgeNAcwBw=="}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}