{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "b002d3160593918e5fff073a9531cd783ea36a632b9dd1ebfbef97fe73a48f5b",
              "tlsh": "2e55c71564fb14321aa330fd6e5b9002b23695073809fda4bb9c86642f8d52dd2f7bed"
            }
          ],
          "package_integrity": [
            {
              "filename": "amaco-os-0.1.0.tgz",
              "hashes": {
                "sha1": "46ac3191b58c2e9ace666fef4d7c28794bca46e0",
                "sha512_sri": "sha512-hW9bN17Vtgfy0EUS+KOEtSrmB4IynMF/HMCyO4+npOTh27FJxlhwOlide4L8cwB887mRFCmBqxjW2gg4zRbX1Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "amaco-os"
      },
      "versions": [
        "0.1.0",
        "0.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004914",
        "import_time": "2026-05-26T15:07:42.27024296Z",
        "modified_time": "2026-05-26T14:06:45Z",
        "sha256": "0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-004928",
        "import_time": "2026-05-26T16:47:31.718003807Z",
        "modified_time": "2026-05-26T15:24:42Z",
        "sha256": "6436049231f63e2a957c42a27783aa3a90fef50449bee7ddd023c3cf40fd116d",
        "source": "amazon-inspector",
        "versions": [
          "0.1.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0a6204f29c39ab7a22921331bf33f2501b27fba9aac6a8b87b833caef9c5f506)\ndist/index.js contains a hardcoded Telegram Bot API endpoint (https://api.telegram.org) referenced from a fetch/POST call alongside process.env access. The pattern \u2014 fetch() + POST + api.telegram.org + process.env \u2014 is the canonical Telegram-bot exfiltration channel used to ship installer-side environment variables (and other host data) to an attacker-controlled bot/chat. Telegram\u0027s Bot API serves as a hardcoded C2: the attacker only needs the bot token embedded in the bundle to receive every installer\u0027s data. There is no legitimate reason for an OS-themed package\u0027s bundle to POST to the Telegram Bot API while reading process.env.\n",
  "id": "MAL-2026-4816",
  "modified": "2026-05-26T18:31:05Z",
  "published": "2026-05-26T14:06:45Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/amaco-os/v/0.1.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/amaco-os/v/0.1.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in amaco-os (npm)",
  "withdrawn": "2026-05-26T18:31:05Z"
}