MAL-2026-3672 Malicious code in 1mi (npm)
Malicious package
Published
MAL-2026-3672 is a malicious package: 1mi (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-3672/ (Markdown: https://insights.sbomify.com/MAL-2026-3672/index.md)
- Package
- 1mi
- Registry
- npm
What is MAL-2026-3672?
MAL-2026-3672 is a malicious package in 1mi, published on 12 May 2026.
Official description
This package masquerades as a Cloudflare Worker Telegraf middleware (README: 'cfworker-middware-telegraf') but its main module unconditionally forwards every inbound Telegram update to a hardcoded attacker-controlled Telegram bot/chat, persists all updates to an author-owned Firestore project 'i—-i', and re-uploads victim-submitted photos to imgbb under a hardcoded author key. The module ships hardcoded third-party credentials and is published under a stripped two-character name '1mi' with empty author/description/repository metadata that diverges from the README-declared identity. Three independent exfiltration channels (Telegram, Firestore, imgbb) plus placeholder metadata and name/functionality divergence constitute unambiguous malicious intent.
What should I do about MAL-2026-3672?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.