MAL-2026-15813

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bt2-api-gateway-node-js/MAL-2026-15813.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-15813

Published

2026-09-01T17:16:24Z

Modified

2026-09-03T06:45:05Z

Summary

Malicious code in bt2-api-gateway-node-js (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b)

bt2-api-gateway-node-js@999.0.1 runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens — and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5–15 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal 'bt2-api-gateway' package.

Source: ossf-package-analysis (e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e)

The OpenSSF Package Analysis project identified 'bt2-api-gateway-node-js' @ 999.0.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Database specific

{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019324",
            "import_time":  "2026-09-02T04:23:32.995602482Z",
            "modified_time":  "2026-09-02T03:57:07Z",
            "sha256":  "1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b",
            "source":  "amazon-inspector",
            "versions":  [
                "999.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-019326",
            "import_time":  "2026-09-02T04:23:33.214039025Z",
            "modified_time":  "2026-09-02T03:57:23Z",
            "sha256":  "dc93cb460e7ec59d420f549dbd0180b89198e4c14228cc6f71b9ee2826a737cd",
            "source":  "amazon-inspector",
            "versions":  [
                "999.0.0"
            ]
        },
        {
            "import_time":  "2026-09-03T06:30:16.971559625Z",
            "modified_time":  "2026-09-01T17:16:24Z",
            "sha256":  "e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e",
            "source":  "ossf-package-analysis",
            "versions":  [
                "999.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / bt2-api-gateway-node-js

Package

Name: bt2-api-gateway-node-js; View open source insights on deps.dev
Purl: pkg:npm/bt2-api-gateway-node-js

Affected ranges

Affected versions

999.*

999.0.0

999.0.1

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "b8c840cabee2ef2ab6178fee79af1df16827c47c486f9a173c532712c292f6be",
            "tlsh":  "1b12339b15fb35598223f27adf5f8017212eada36106dd443a0c89d01f4c66cdba1f9c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "bt2-api-gateway-node-js-999.0.1.tgz",
            "hashes":  {
                "sha1":  "93c33d4fe45b7be2550c6826368c1792257e07a4",
                "sha512_sri":  "sha512-7id6Y1Cq4D6jtoUq7BtAJ5hgEQO1zIAKseCSIG+7ZfG7aYEIWKl4TnFMeOd/igVYIhOqogrjGbGHGQ9zRvNh1A=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bt2-api-gateway-node-js/MAL-2026-15813.json"