{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "b8c840cabee2ef2ab6178fee79af1df16827c47c486f9a173c532712c292f6be",
              "tlsh": "1b12339b15fb35598223f27adf5f8017212eada36106dd443a0c89d01f4c66cdba1f9c"
            }
          ],
          "package_integrity": [
            {
              "filename": "bt2-api-gateway-node-js-999.0.1.tgz",
              "hashes": {
                "sha1": "93c33d4fe45b7be2550c6826368c1792257e07a4",
                "sha512_sri": "sha512-7id6Y1Cq4D6jtoUq7BtAJ5hgEQO1zIAKseCSIG+7ZfG7aYEIWKl4TnFMeOd/igVYIhOqogrjGbGHGQ9zRvNh1A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "bt2-api-gateway-node-js"
      },
      "versions": [
        "999.0.1",
        "999.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-019324",
        "import_time": "2026-09-02T04:23:32.995602482Z",
        "modified_time": "2026-09-02T03:57:07Z",
        "sha256": "1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b",
        "source": "amazon-inspector",
        "versions": [
          "999.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-019326",
        "import_time": "2026-09-02T04:23:33.214039025Z",
        "modified_time": "2026-09-02T03:57:23Z",
        "sha256": "dc93cb460e7ec59d420f549dbd0180b89198e4c14228cc6f71b9ee2826a737cd",
        "source": "amazon-inspector",
        "versions": [
          "999.0.0"
        ]
      },
      {
        "import_time": "2026-09-03T06:30:16.971559625Z",
        "modified_time": "2026-09-01T17:16:24Z",
        "sha256": "e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e",
        "source": "ossf-package-analysis",
        "versions": [
          "999.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b)\nbt2-api-gateway-node-js@999.0.1 runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk \u2014 ~/.ssh private keys, ~/.aws/{credentials,config,sso/cache}, ~/.azure, gcloud ADC, ~/.kube/config, ~/.docker/config.json, gh hosts.yml, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gem/credentials, ~/.cargo/credentials, ~/.pgpass, ~/.my.cnf, and vercel/netlify/supabase/firebase tokens \u2014 and sweeps process.env for TOKEN/KEY/SECRET/PASSWORD and AWS/AZURE/GITHUB/STRIPE variables. The collected data is JSON-serialized, base64-encoded, and POSTed to two hardcoded destinations: the Telegram Bot API (api.telegram.org/bot\u003ctoken\u003e/sendMessage) and http://2.26.82.63:8888/collect over plain HTTP. Execution aborts if NODE_ENV=test, CI=true, JEST_WORKER_ID or VITEST is set, or /.dockerenv exists, and is delayed by a randomized 5\u201315 second setTimeout to evade CI and sandbox observation. The version number (999.0.1) and package name are consistent with a dependency-confusion lure targeting an internal \u0027bt2-api-gateway\u0027 package.\n\n## Source: ossf-package-analysis (e3a3256b290402643d8dc39967ec2724fdbc490105a0581a1e3c1b2d96faee3e)\nThe OpenSSF Package Analysis project identified \u0027bt2-api-gateway-node-js\u0027 @ 999.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-15813",
  "modified": "2026-09-03T06:32:12.233236423Z",
  "published": "2026-09-01T17:16:24Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/bt2-api-gateway-node-js/v/999.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in bt2-api-gateway-node-js (npm)"
}