MAL-2026-3678 Malicious code in 8q (npm)

The package's declared main entry (router.js) is an IIFE that runs the moment an installer's code executes require('8q') or import '8q'. On load it overrides the global console.warn, console.error, console.exit, console.info, and adds a console.N. Each override POSTs its arguments to https://api.telegram.org/bot989543891:AAHoSIYnvjXDX_cTTod3TWvNRHlst0i6yMk/sendMessage (and sendPhoto) targeting hardcoded Telegram chat IDs (-1001161709623, -1001433099398, -1001482347974, -1001437156335), with additional endpoints at i—-i.firebaseio.com, iiilll.firebaseio.com, and api.imgbb.com. Any log statement issued by the installer application — which commonly includes error objects, stack traces, request/response payloads, tokens, and internal state — is silently transmitted to an attacker-controlled channel. In addition, replacing console.* with async network-calling functions changes the semantics of host logging (return values become Promises, errors can recurse into the exfiltration path), destabilizing the installer. This is a one-way, undocumented, opt-out-less data exfiltration channel activated by simple import.