MAL-2026-4518 Malicious code in cheaty-sync-bot (npm)

cheaty-sync-bot ships a clipboard-sync CLI that hardcodes a single Telegram bot token (index.js:10) owned by the package author. There is no configuration path for installers to supply their own bot — every user of this tool connects to the same author-controlled relay. Two concrete harms result: (1) Silent-relay: clipboard contents (text and images) and installer chat identifiers flow through the author's Telegram bot, giving the author visibility into every installer's session via getUpdates polling. (2) Backdoor / remote code execution: incoming Telegram messages are interpolated into a PowerShell command (powershell -Command "Set-Clipboard -Value \"${escapedText}\"") at index.js:31-34 and passed to exec(). The escaping only replaces double quotes with backtick-quotes; PowerShell metacharacters such as backticks, $(...) subexpressions, and newlines are not sanitized, so anyone holding the bot token (the author, or anyone who obtains it) can send a crafted message to any installer running the CLI and achieve arbitrary command execution on the Windows host.