Do Son 
These malicious packages duplicate the README of the legitimate one to create a false sense of authenticity and deceive developers.
Experts at Socket have uncovered a new software supply chain attack involving counterfeit npm libraries masquerading as the widely used Telegram Bot API. These malicious packages covertly implant SSH backdoors and data exfiltration modules into unsuspecting systems.
Telegram has become an increasingly attractive target for threat actors: by 2025, its monthly user base surpassed one billion, including over 12 million paid subscribers. The platform offers developers an open API for building bots, yet lacks a formal code review process prior to publication—unlike the vetting systems found in the App Store or Google Play. This permissive environment fosters creativity among enthusiasts but also opens the door to malicious exploitation.
Socket identified three npm libraries—node-telegram-utils, node-telegram-bots-api, and node-telegram-util—each designed to impersonate the legitimate node-telegram-bot-api, a package with millions of downloads. These impostor libraries replicate the original’s README in full, while employing a deceptive technique known as starjacking, wherein GitHub links are manipulated to display the star rating of the genuine repository. The result is a convincing facade that lulls developers into a false sense of security.
Though the malicious packages amassed only around 300 downloads, the potential consequences of a single installation are profound. Upon execution, the embedded code checks whether the host system is running Linux. If so, it silently triggers the addBotId() function, which implants two attacker-controlled SSH keys into the ~/.ssh/authorized_keys file—granting persistent, passwordless remote access. Even if the malicious package is later removed, the keys remain, ensuring the attacker’s foothold endures.
Beyond SSH access, the malware also collects the victim’s username and external IP address, transmitting this data to a remote server hosted at solana.validator.blog, thereby confirming successful compromise. The elegance of this attack lies in its stealth: it weaves itself seamlessly into the supply chain with surgical precision.
The entire malicious payload spans a mere 40 lines of code, discreetly embedded within a library that is visually indistinguishable from its authentic counterpart. It operates in silence, requiring no user interaction—one execution is enough to compromise the system entirely.
This incident starkly illustrates the fragility of modern development practices when it comes to dependency trust. Many software projects naively assume the integrity of third-party packages, unaware that every npm install could potentially hand over control of their infrastructure to unknown actors.
To mitigate such threats, it is essential to employ automated tools for dependency analysis and real-time monitoring—both during download and at the point of integration. Avoiding manual installation of unverified packages and implementing layered security measures throughout development and build processes are vital steps in securing the software supply chain. In an era of increasingly sophisticated attacks, such vigilance is no longer merely advisable—it is imperative.
