{"id":"MAL-2026-19151","kind":"package","aliases":["MAL-2026-19151"],"related":[],"title":"Malicious code in carboniteapp (npm)","description":"Malicious package. `carboniteapp` runs an install-time script (`node index.js` via its npm install hook) that collects host information, resolves the victim's public IP via api.ipify.org, and exfiltrates the collected data to an attacker-controlled Telegram bot (api.telegram.org). No legitimate functionality; the package exists solely to beacon/exfiltrate on install, so all published versions are malicious. Published 2026-05-06 and removed from npm the same day. Full context at the reference below.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"carboniteapp","note":"all versions","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T05:30:00+00:00","first_seen_at":"2026-11-12T07:06:34+00:00","triaged_at":"2026-11-12T07:06:45+00:00","updated_at":"2026-11-12T07:07:37+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-05':75C '-06':76C '-19151':8A,11A '-2026':7A,10A '2026':74C 'api.ipify.org':42C 'api.telegram.org':55C 'attack':51C 'attacker-control':50C 'beacon/exfiltrate':64C 'bot':54C 'carboniteapp':4A,12A,17C 'code':2A 'collect':32C,46C 'context':85C 'control':52C 'data':47C 'day':83C 'exfiltr':44C 'exist':61C 'full':84C 'function':58C 'hook':30C 'host':33C 'index.js':25C 'inform':34C 'instal':21C,29C,66C 'install-tim':20C 'ip':40C 'legitim':57C 'mal':6A,9A 'malici':1A,13B,15C,72C 'node':24C 'npm':5A,28C,80C 'packag':14B,16C,60C 'public':39C 'publish':69C,73C 'refer':88C 'remov':78C 'resolv':35C 'run':18C 'script':23C 'sole':62C 'telegram':53C 'time':22C 'version':70C 'via':26C,41C 'victim':37C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["carboniteapp"],"ptokens":["carboniteapp"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19151':8A,11A '-2026':7A,10A 'carboniteapp':4A,12A 'code':2A 'mal':6A,9A 'malici':1A 'npm':5A","search_b":"'malici':13B 'packag':14B","search_c":"'-05':75C '-06':76C '2026':74C 'api.ipify.org':42C 'api.telegram.org':55C 'attack':51C 'attacker-control':50C 'beacon/exfiltrate':64C 'bot':54C 'carboniteapp':17C 'collect':32C,46C 'context':85C 'control':52C 'data':47C 'day':83C 'exfiltr':44C 'exist':61C 'full':84C 'function':58C 'hook':30C 'host':33C 'index.js':25C 'inform':34C 'instal':21C,29C,66C 'install-tim':20C 'ip':40C 'legitim':57C 'malici':15C,72C 'node':24C 'npm':28C,80C 'packag':16C,60C 'public':39C 'publish':69C,73C 'refer':88C 'remov':78C 'resolv':35C 'run':18C 'script':23C 'sole':62C 'telegram':53C 'time':22C 'version':70C 'via':26C,41C 'victim':37C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19151","url":"https://osv.dev/vulnerability/MAL-2026-19151","severity":"critical","published_at":"2026-11-10T05:30:00+00:00","modified_at":"2026-11-12T05:45:05+00:00","first_seen_at":"2026-11-12T07:06:34+00:00","fetched_at":"2026-11-12T07:06:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}