Malicious Code Injection in @siriusbeyond/utils: A Critical Security Threat
Summary
MAL-2026-16322: Malicious code in @siriusbeyond/utils (npm). Affects @siriusbeyond/utils versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @siriusbeyond/utils is an npm library designed for utility functions within JavaScript applications. It is commonly used for various tasks, but its recent version 99.0.0 has been compromised, introducing a severe security vulnerability. This vulnerability allows malicious code to execute during the installation process, posing significant risks to users and their environments.
Vulnerability Detail
The vulnerability originates from the inclusion of preinstall and postinstall scripts in the package that execute a file named callback.js. This script performs host reconnaissance by collecting sensitive information such as hostname, username, and environment variables that may contain credentials. The collected data is then sent to a hardcoded Telegram bot, effectively exfiltrating sensitive information without user consent. This behavior is indicative of a dependency-confusion attack, which can lead to unauthorized access and data breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @siriusbeyond/utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected version of the package by removing it from your project and replacing it with alternative libraries that provide similar functionality without the associated risks. Additionally, you can disable the execution of scripts during npm install by using the following command: npm install --ignore-scripts.
Conclusion
The @siriusbeyond/utils package has been compromised, leading to a critical vulnerability that can expose sensitive information. It is crucial for developers to update their dependencies and utilize tools like Vulert to monitor for vulnerabilities in their applications. Taking proactive measures will help safeguard against potential threats.
See every vulnerability recorded for @siriusbeyond/utils →
FAQ
The vulnerability allows malicious code to collect sensitive information from the host system and send it to an external server, potentially leading to data breaches.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
To prevent similar vulnerabilities, regularly update your dependencies, audit your packages for known vulnerabilities, and use tools like Vulert to monitor your applications.
If an immediate update is not possible, consider removing the package or using an alternative library until a fix is available.
Detailed information about this vulnerability can be found in the official security advisory and on platforms like Vulert, which provide insights into open-source vulnerabilities.
