Supply Chain Attack Targeting Telegram Bot Developers Through Typosquatted npm Packages

Summary

Socket’s Threat Research Team has uncovered a supply chain attack targeting the Telegram bot development ecosystem through typosquatted npm packages. Masquerading as the legitimate and widely-used node-telegram-bot-api library, these malicious packages—node-telegram-utils, node-telegram-bots-api, and node-telegram-util—secretly deliver SSH backdoors and data exfiltration mechanisms. Although these typosquatted libraries have only been downloaded around 300 times, the impact can be severe, as even a single compromised development environment can lead to broader security breaches across systems and infrastructure.

Telegram’s open and unregulated Bot API ecosystem, lacking formal vetting or a centralized app store, creates a ripe opportunity for abuse. The attackers copied the README from the legitimate package and linked to its official GitHub repo to “starjack” its 19K+ stars, misleading developers into trusting the malicious versions.

Technical Details

The malicious Telegram packages are designed to automatically execute a hidden function, addBotId(), whenever the constructor is invoked, enabling stealthy compromise with no user interaction.

Automatic, Linux-Specific Execution:

The addBotId() function first checks the operating system using os.platform(). If the environment is Linux, the malicious routine is triggered immediately, requiring no user action.

SSH Key Injection:

The code silently appends two attacker-controlled SSH keys to the ~/.ssh/authorized_keys file. This grants persistent, passwordless remote access. Even if one key is removed, the second remains as a fallback for continued access.

Data Exfiltration:

The script gathers the system’s external IP address (via ipinfo[.]io/ip) and the current username, then sends this information to solana[.]validator[.]blog, signaling a successful compromise. Because this malicious logic—roughly 40 lines—is buried within an otherwise legitimate-looking Telegram bot library, developers are unlikely to notice it. Simply uninstalling the package does not remove the injected SSH keys, leaving the system vulnerable to ongoing unauthorized access.

Recommendations

• Before using any Python or npm package, review its source code and ensure it comes from a trusted and reputable source.

• Use strong passwords and enforce multi-factor authentication wherever possible.

• Turn on the automatic software update feature on your computer, mobile, and other connected devices.

• Use a reputable anti-virus and internet security software package on your connected devices, including PC, laptop, and mobile.

• Refrain from opening untrusted links and email attachments without first verifying their authenticity.

• Educate employees on protecting themselves from threats like phishing/untrusted URLs.

• Block URLs that could be used to spread malware, e.g., Torrent/Warez.

• Monitor the beacon on the network level to block data exfiltration by malware or TAs.

• Enable Data Loss Prevention (DLP) Solutions on the employees’ systems.

Conclusion

The recent discovery of malicious npm packages targeting Telegram bots (such as nodetelegram-utils and node-telegram-bots-api) underscores the ongoing risks to the software supply chain. Even one compromised development machine or production server can grant attackers a pathway for broader infiltration, unauthorized SSH access, and sensitive data theft. Threat actors are increasingly exploiting the trust in open-source ecosystems like npm to distribute malware disguised as legitimate packages. Based on current trends, future attacks will likely involve more sophisticated obfuscation techniques and dynamic payload delivery methods.