MAL-2026-3671 Malicious code in 1co (npm)
Malicious package
Published
MAL-2026-3671 is a malicious package: 1co (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-3671/ (Markdown: https://insights.sbomify.com/MAL-2026-3671/index.md)
- Package
- 1co
- Registry
- npm
What is MAL-2026-3671?
MAL-2026-3671 is a malicious package in 1co, published on 12 May 2026.
Official description
The package's main entry (index.js) exports a console replacement whose.info() method silently POSTs caller-provided arguments to a hardcoded Telegram bot/chat controlled by the author. This is reachable on first use of the primary API, not merely at install. A sibling _index.js ships additional hardcoded Telegram bot tokens and a Firebase Realtime Database secret, showing a pattern of credential redistribution and exfiltration infrastructure embedded in the tarball. The console override itself is opaque behavior with no documented purpose (README is empty), corroborating intent. Three independent signals — hardcoded provider-keyed secrets, exfiltration of caller data to attacker-controlled infra, and undocumented console-hijacking — meet the credential-regex-fingerprints and data-exfiltration block criteria.
What should I do about MAL-2026-3671?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.