{"answers":{"affected":"1 open source package ship an affected version, including siriusbeyond.","exploited":"There is no known exploitation of MAL-2026-16343 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16343 is a malicious package in siriusbeyond, published on 21 Sep 2026."},"fix_prompt":"MAL-2026-16343 is a malicious package: siriusbeyond (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16343/ (Markdown: https://insights.sbomify.com/MAL-2026-16343/index.md)","id":"MAL-2026-16343","markdown":"https://insights.sbomify.com/MAL-2026-16343/index.md","name":"MAL-2026-16343","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so `npm install siriusbeyond` executes it automatically. callback.js collects hostname, username, platform, cwd, home directory, uid/gid/pid, network interface details, CI/cloud environment indicators, and a list of process.env variable names matching approximately 35 credential-shaped regexes (token, secret, key, password, aws, azure, gcp, npm, git, ssh, jwt, database, stripe, slack, discord, webhook, etc.), together with existence checks for.env,.npmrc, credentials, and secrets.json in the working directory. The collected payload is POSTed to api.telegram.org using a hardcoded bot token and chat id (chat 1064260758). A secondary channel base64-encodes a JSON blob of host, user, and CI fields and issues a dns.resolve() against `\u003cbase64\u003e.dc-callback.example.com`, providing a DNS-tunnel exfil path when outbound HTTPS is blocked. Even though variable values are not sent, the disclosed variable names and credential-file inventory identify which secrets the installer holds and enable targeted follow-on attack.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in siriusbeyond (npm)","id":"MAL-2026-16343","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"siriusbeyond","purl":"pkg:npm/siriusbeyond","source":"MAL-2026-16343"}],"products":null,"published":"2026-09-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16343/"}