Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems
Three malicious packages that pose as a well-known Telegram bot library but actually contain SSH backdoors and data exfiltration capabilities have been discovered by cybersecurity experts in the npm registry.
Below is a list of the disputed packages:
node-telegram-utils (132 downloads)
node-telegram-bots-api (82 downloads)
node-telegram-util (73 downloads)
The packages are made to look like node-telegram-bot-api, a well-known Node.js Telegram Bot API with over 100,000 downloads every week, according to supply chain security company Socket. You are still able to download the three libraries.
According to security researcher Kush Pandya, even though that figure might seem low, it only takes one compromised environment to open the door for widespread infiltration or illeg...