{"id":"MAL-2026-4816","summary":"Malicious code in amaco-os (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506)\ndist/index.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) referenced from a fetch/POST call alongside process.env access. The pattern — fetch() + POST + api.telegram.org + process.env — is the canonical Telegram-bot exfiltration channel used to ship installer-side environment variables (and other host data) to an attacker-controlled bot/chat. Telegram's Bot API serves as a hardcoded C2: the attacker only needs the bot token embedded in the bundle to receive every installer's data. There is no legitimate reason for an OS-themed package's bundle to POST to the Telegram Bot API while reading process.env.\n","modified":"2026-05-27T00:32:11.754695803Z","published":"2026-05-26T14:06:45Z","withdrawn":"2026-05-26T18:31:05Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506","versions":["0.1.0"],"modified_time":"2026-05-26T14:06:45Z","id":"IN-MAL-2026-004914","import_time":"2026-05-26T15:07:42.27024296Z"},{"source":"amazon-inspector","sha256":"6436049231f63e2a957c42a27783aa3a90fef50449bee7ddd023c3cf40fd116d","versions":["0.1.1"],"modified_time":"2026-05-26T15:24:42Z","id":"IN-MAL-2026-004928","import_time":"2026-05-26T16:47:31.718003807Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/amaco-os/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/amaco-os/v/0.1.1"}],"affected":[{"package":{"name":"amaco-os","ecosystem":"npm","purl":"pkg:npm/amaco-os"},"versions":["0.1.0","0.1.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/amaco-os/MAL-2026-4816.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"amaco-os-0.1.0.tgz","hashes":{"sha1":"46ac3191b58c2e9ace666fef4d7c28794bca46e0","sha512_sri":"sha512-hW9bN17Vtgfy0EUS+KOEtSrmB4IynMF/HMCyO4+npOTh27FJxlhwOlide4L8cwB887mRFCmBqxjW2gg4zRbX1Q=="}}],"evidence_files":[{"sha256":"b002d3160593918e5fff073a9531cd783ea36a632b9dd1ebfbef97fe73a48f5b","path":"dist/index.js","tlsh":"2e55c71564fb14321aa330fd6e5b9002b23695073809fda4bb9c86642f8d52dd2f7bed"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}