MAL-2026-15813

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bt2-api-gateway-node-js/MAL-2026-15813.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15813
Published
2026-09-02T03:57:07Z
Modified
2026-09-02T04:30:05.682309187Z
Summary
Malicious code in bt2-api-gateway-node-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b)

bt2-api-gateway-node-js@999.0.1 runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens — and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot<token>/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODEENV=test, CI=true, JESTWORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5–15 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal 'bt2-api-gateway' package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-02T04:23:32.995602482Z",
            "source": "amazon-inspector",
            "versions": [
                "999.0.1"
            ],
            "id": "IN-MAL-2026-019324",
            "modified_time": "2026-09-02T03:57:07Z",
            "sha256": "1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b"
        },
        {
            "import_time": "2026-09-02T04:23:33.214039025Z",
            "source": "amazon-inspector",
            "versions": [
                "999.0.0"
            ],
            "id": "IN-MAL-2026-019326",
            "modified_time": "2026-09-02T03:57:23Z",
            "sha256": "dc93cb460e7ec59d420f549dbd0180b89198e4c14228cc6f71b9ee2826a737cd"
        }
    ]
}
References
Credits

Affected packages

npm / bt2-api-gateway-node-js

Package

Name
bt2-api-gateway-node-js
View open source insights on deps.dev
Purl
pkg:npm/bt2-api-gateway-node-js

Affected ranges

Affected versions

999.*
999.0.0
999.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bt2-api-gateway-node-js/MAL-2026-15813.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "1b12339b15fb35598223f27adf5f8017212eada36106dd443a0c89d01f4c66cdba1f9c",
            "sha256": "b8c840cabee2ef2ab6178fee79af1df16827c47c486f9a173c532712c292f6be"
        }
    ],
    "package_integrity": [
        {
            "filename": "bt2-api-gateway-node-js-999.0.1.tgz",
            "hashes": {
                "sha1": "93c33d4fe45b7be2550c6826368c1792257e07a4",
                "sha512_sri": "sha512-7id6Y1Cq4D6jtoUq7BtAJ5hgEQO1zIAKseCSIG+7ZfG7aYEIWKl4TnFMeOd/igVYIhOqogrjGbGHGQ9zRvNh1A=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]