MAL-2026-16320

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@siriusbeyond/auth/MAL-2026-16320.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16320
Published
2026-09-20T09:35:26Z
Modified
2026-09-21T05:30:06Z
Summary
Malicious code in @siriusbeyond/auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695)

Package @siriusbeyond/auth@99.0.0 registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install. callback.js collects installer host identifiers (hostname, username, platform, cwd, homedir, CI/cloud indicators, npm registry) together with a filtered list of environment variable names matching token/secret/key/password/aws/npm/git patterns, and POSTs a Markdown report to https://api.telegram.org/bot/sendMessage using a hardcoded bot token and chat_id 1064260758 embedded in the source. The lifecycle commands are wrapped in 2>/dev/null || true to suppress errors and hide the beacon from install output. The version number 99.0.0 and private-scope name are the standard dependency-confusion shape targeting the @siriusbeyond scope, causing internal builds that reference that scope to resolve to this public package and beacon out. The package's self-description as a 'Dependency Confusion PoC / security research' does not change the runtime behavior: installer-owned data leaves every machine that installs it to an author-controlled Telegram channel.

Source: ossf-package-analysis (1d6b359a24803199b8b8cbc77aed1c8ceac0706a76db4ec00a9964bf1f8b1e37)

The OpenSSF Package Analysis project identified '@siriusbeyond/auth' @ 99.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020219",
            "import_time":  "2026-09-21T03:46:36.974080125Z",
            "modified_time":  "2026-09-21T03:29:00Z",
            "sha256":  "4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        },
        {
            "import_time":  "2026-09-21T05:19:22.137498381Z",
            "modified_time":  "2026-09-20T09:35:26Z",
            "sha256":  "1d6b359a24803199b8b8cbc77aed1c8ceac0706a76db4ec00a9964bf1f8b1e37",
            "source":  "ossf-package-analysis",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @siriusbeyond/auth

Package

Name
@siriusbeyond/auth
View open source insights on deps.dev
Purl
pkg:npm/%40siriusbeyond/auth

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "callback.js",
            "sha256":  "92acd9d29ba169e07719394d8c8a097a29cd548d4fa5f3afa38a9c953675e90d",
            "tlsh":  "ca71e7c852ebd5221be116d76559bc036946e0073f0db1623a1c53906fc896d87727ff"
        },
        {
            "path":  "package.json",
            "sha256":  "ac241aed2e1089295fe50cbd411761607313c4c0467f769a750333428525f656",
            "tlsh":  "2ee0f1645e080b233de8ced93435c70190395d1f0cac782513b3498491ce7624a7d3bf"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "auth-99.0.0.tgz",
            "hashes":  {
                "sha1":  "bf75d87a70558f6e77d9e7cd483e50db21a5c41c",
                "sha512_sri":  "sha512-ZKKt9ZCcPED5I9Fg1FCpN90rfpjbh6BtwL4zfe+pKfTGYWizWSHh0nnontNICGVd1c6uVAKsNcyXvL9axo4hfw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@siriusbeyond/auth/MAL-2026-16320.json"