MAL-2026-4816

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/amaco-os/MAL-2026-4816.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4816
Withdrawn
2026-05-26T18:31:05Z
Published
2026-05-26T14:06:45Z
Modified
2026-05-27T00:32:11.754695803Z
Summary
Malicious code in amaco-os (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506)

dist/index.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) referenced from a fetch/POST call alongside process.env access. The pattern — fetch() + POST + api.telegram.org + process.env — is the canonical Telegram-bot exfiltration channel used to ship installer-side environment variables (and other host data) to an attacker-controlled bot/chat. Telegram's Bot API serves as a hardcoded C2: the attacker only needs the bot token embedded in the bundle to receive every installer's data. There is no legitimate reason for an OS-themed package's bundle to POST to the Telegram Bot API while reading process.env.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.0"
            ],
            "sha256": "0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506",
            "modified_time": "2026-05-26T14:06:45Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T15:07:42.27024296Z",
            "id": "IN-MAL-2026-004914"
        },
        {
            "versions": [
                "0.1.1"
            ],
            "sha256": "6436049231f63e2a957c42a27783aa3a90fef50449bee7ddd023c3cf40fd116d",
            "modified_time": "2026-05-26T15:24:42Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T16:47:31.718003807Z",
            "id": "IN-MAL-2026-004928"
        }
    ]
}
References
Credits

Affected packages

npm / amaco-os

Package

Name
amaco-os
View open source insights on deps.dev
Purl
pkg:npm/amaco-os

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "amaco-os-0.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-hW9bN17Vtgfy0EUS+KOEtSrmB4IynMF/HMCyO4+npOTh27FJxlhwOlide4L8cwB887mRFCmBqxjW2gg4zRbX1Q==",
                "sha1": "46ac3191b58c2e9ace666fef4d7c28794bca46e0"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "b002d3160593918e5fff073a9531cd783ea36a632b9dd1ebfbef97fe73a48f5b",
            "path": "dist/index.js",
            "tlsh": "2e55c71564fb14321aa330fd6e5b9002b23695073809fda4bb9c86642f8d52dd2f7bed"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/amaco-os/MAL-2026-4816.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]