# Supply Chain Attack Targeting Telegram Bot Developers Through Typosquatted npm Packages

## **Summary**

Socket’s Threat Research Team has uncovered a supply chain attack targeting the Telegram bot development ecosystem through typosquatted npm packages. Masquerading as the legitimate and widely-used node-telegram-bot-api library, these malicious packages—node-telegram-utils, node-telegram-bots-api, and node-telegram-util—secretly deliver SSH backdoors and data exfiltration mechanisms. Although these typosquatted libraries have only been downloaded around 300 times, the impact can be severe, as even a single compromised development environment can lead to broader security breaches across systems and infrastructure.

Telegram’s open and unregulated Bot API ecosystem, lacking formal vetting or a centralized app store, creates a ripe opportunity for abuse. The attackers copied the README from the legitimate package and linked to its official GitHub repo to “starjack” its 19K+ stars, misleading developers into trusting the malicious versions. 

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1745255218605/b3d7665e-e3da-4654-ac7d-b98e05abca61.png align="center")

## Technical Details

The malicious Telegram packages are designed to automatically execute a hidden function, addBotId(), whenever the constructor is invoked, enabling stealthy compromise with no user interaction.

**Automatic, Linux-Specific Execution:**

The addBotId() function first checks the operating system using os.platform(). If the environment is Linux, the malicious routine is triggered immediately, requiring no user action.

**SSH Key Injection:**

The code silently appends two attacker-controlled SSH keys to the ~/.ssh/authorized\_keys file. This grants persistent, passwordless remote access. Even if one key is removed, the second remains as a fallback for continued access.

**Data Exfiltration:**

The script gathers the system’s external IP address (via ipinfo\[.\]io/ip) and the current username, then sends this information to solana\[.\]validator\[.\]blog, signaling a successful compromise. Because this malicious logic—roughly 40 lines—is buried within an otherwise legitimate-looking Telegram bot library, developers are unlikely to notice it. Simply uninstalling the package does not remove the injected SSH keys, leaving the system vulnerable to ongoing unauthorized access.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1745255387712/2c1655cb-e029-4d1a-adab-e766084bea60.png align="center")

## Recommendations

* Before using any Python or npm package, review its source code and ensure it comes from a trusted and reputable source.
    
* Use strong passwords and enforce multi-factor authentication wherever possible.
    
* Turn on the automatic software update feature on your computer, mobile, and other connected devices.
    
* Use a reputable anti-virus and internet security software package on your connected devices, including PC, laptop, and mobile.
    
* Refrain from opening untrusted links and email attachments without first verifying their authenticity.
    
* Educate employees on protecting themselves from threats like phishing/untrusted URLs.
    
* Block URLs that could be used to spread malware, e.g., Torrent/Warez.
    
* Monitor the beacon on the network level to block data exfiltration by malware or TAs.
    
* Enable Data Loss Prevention (DLP) Solutions on the employees’ systems.
    

## Conclusion

The recent discovery of malicious npm packages targeting Telegram bots (such as nodetelegram-utils and node-telegram-bots-api) underscores the ongoing risks to the software supply chain. Even one compromised development machine or production server can grant attackers a pathway for broader infiltration, unauthorized SSH access, and sensitive data theft. Threat actors are increasingly exploiting the trust in open-source ecosystems like npm to distribute malware disguised as legitimate packages. Based on current trends, future attacks will likely involve more sophisticated obfuscation techniques and dynamic payload delivery methods.