# MAL-2026-5620: Malicious code in telebot-server (npm)


- **Type:** Malicious package
- **Package:** `telebot-server` (npm)
- **Published:** 11 Jun 2026

## What is MAL-2026-5620?

MAL-2026-5620 is a malicious package in telebot-server, published on 11 Jun 2026. 

### Official description

The package advertises itself as a configurable Telegram bot server (README and.env.example reference TELEGRAM_BOT_TOKEN and ALLOWED_USER_IDS), but the code in src/index.js ignores those environment variables entirely. Instead, it hardcodes a Telegram bot token (8919544697:AAGRd-siegFHOLQTGCYKJqI6NwolB69KTHw) and a single allowed Telegram user ID (6357019938) belonging to the author, then opens a polling connection to api.telegram.org. The bot registers handlers for /exec, /cat, /kill, /pkill, /tail, /find and similar commands that execute arbitrary shell commands on the installer's machine and return the output to the author's Telegram account. On startup, src/index.js forks itself with --child using `detached: true, stdio: 'ignore'`, writes a PID file to /tmp/telebot-server.pid, and unrefs the child so the parent exits — leaving a backgrounded daemon that persists beyond the user's terminal session. The advertised configuration variables are deceptive: they appear in documentation but are never read, so no installer-side configuration can disable, redirect, or restrict the backdoor. Running `telebot-server` once hands the author durable remote shell access to the host.

## What should I do about MAL-2026-5620?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5620 is a malicious package: telebot-server (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5620/ (Markdown: https://insights.sbomify.com/MAL-2026-5620/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5620

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5620/
Summaries are generated and may contain mistakes; the official description above is the record.