Malicious Code Detected in @siriusbeyond/auth Package: Security Risk Alert
Summary
MAL-2026-16320: Malicious code in @siriusbeyond/auth (npm). Affects @siriusbeyond/auth versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @siriusbeyond/auth package is an npm library that is intended for authentication purposes. However, version 99.0.0 of this package has been identified as malicious, embedding harmful code that compromises user data. The package registers preinstall and postinstall lifecycle scripts that execute a script named callback.js, which collects sensitive information from the user's environment.
Vulnerability Detail
The vulnerability originates from the malicious code embedded in the @siriusbeyond/auth package version 99.0.0. This code executes during the installation process, collecting sensitive data such as the hostname, username, and environment variables that may contain tokens or passwords. The collected data is then sent to a Telegram channel controlled by the attacker, posing a significant risk to user privacy and security. The package's design exploits dependency confusion, allowing it to be installed in environments that reference the @siriusbeyond scope, leading to potential data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @siriusbeyond/authIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the malicious package by using npm's package-lock.json to lock your dependencies to a safe version. Additionally, you can monitor your project for vulnerabilities using tools like Vulert, which analyzes your package-lock.json file to alert you of any open-source vulnerabilities in real-time.
Conclusion
The @siriusbeyond/auth package version 99.0.0 contains malicious code that poses a serious security risk by collecting sensitive user data. It is crucial to uninstall this version and monitor your dependencies to prevent future vulnerabilities. Utilizing tools like Vulert can help maintain the security of your open-source software.
See every vulnerability recorded for @siriusbeyond/auth →
FAQ
The vulnerability involves malicious code that collects sensitive user data and sends it to an external Telegram channel.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
You should uninstall the affected version and install the latest secure version of the package to mitigate the risk.
The malicious code is executed through preinstall and postinstall lifecycle scripts that run automatically when the package is installed.
Yes, regularly monitor your dependencies using tools like Vulert and ensure to review package integrity before installation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
