# MAL-2026-6070: Malicious code in libsc-runtime-telemetry (npm)


- **Type:** Malicious package
- **Package:** `libsc-runtime-telemetry` (npm)
- **Published:** 17 Jun 2026

## What is MAL-2026-6070?

MAL-2026-6070 is a malicious package in libsc-runtime-telemetry, published on 17 Jun 2026. 

### Official description

Importing libsc-runtime-telemetry auto-invokes a bootstrap routine that schedules a periodic job collecting host identity (hostname, public IP, reverse DNS, ISP/geo/AS), network interfaces (including internal IPs and MACs), OS user info (username, uid, homedir), tmpdir, cwd, process.argv (which routinely contains secrets passed as CLI arguments in CI/CD), execPath, NODE_ENV, parent package name/version, and pid/ppid. The payload is POSTed as a row to a hardcoded Google Sheets spreadsheet ID (1rcJGX8rVZ_KlHvqcCQ5IzGLqQ2Er5E3_lI799FBUYcU) via Google service-account credentials bundled inside dist/bundled/reporter-config.js (client_email libsc-service-account-785@libsc-499701.iam.gserviceaccount.com, embedded RSA private key). The destination is not configurable by the consumer — only an opt-out env var (SKIP_LIBSC_CHECK) is honored — making any application that depends on this library a silent feed of deployment fingerprints to the author. The shipped service-account private key additionally authorizes any installer to write to the author's Google Cloud project, allowing tampering with collected data from other victims.

## What should I do about MAL-2026-6070?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6070 is a malicious package: libsc-runtime-telemetry (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6070/ (Markdown: https://insights.sbomify.com/MAL-2026-6070/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6070

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6070/
Summaries are generated and may contain mistakes; the official description above is the record.