Critical Malicious Code Vulnerability in botmaker-cli Package
Summary
MAL-2026-17502: Malicious code in botmaker-cli (npm). Affects botmaker-cli versions 0.1.19. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The botmaker-cli package is a command-line interface tool designed for developers to interact with the Botmaker platform. It is intended to streamline bot creation and management processes. However, this package has been found to contain malicious code that compromises user security and system integrity during installation.
Vulnerability Detail
The vulnerability originates from a malicious post-installation script (postinstall.js) that collects sensitive information from the user's system, including hostname, username, current working directory, architecture, platform, and network interface details. This information is sent to a hardcoded external server (telemetry-edge.net) over HTTPS with certificate validation disabled. Furthermore, the script executes arbitrary commands received from the server, allowing an attacker to gain control over the user's machine. This poses significant risks, including data theft and unauthorized access to sensitive systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall botmaker-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate this vulnerability. The best course of action is to uninstall the botmaker-cli package and refrain from using it.
Conclusion
The botmaker-cli package contains a critical vulnerability that allows malicious actors to execute arbitrary commands on user systems. It is essential to uninstall this package and monitor your applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for botmaker-cli →
FAQ
botmaker-cli is a command-line interface tool for developers to manage and create bots on the Botmaker platform.
The vulnerability allows an attacker to collect sensitive information from your system and execute arbitrary commands, potentially leading to data theft and unauthorized access.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
No, there is currently no patched version available for the botmaker-cli package. It is advised to uninstall it immediately.
If you have installed botmaker-cli, you should uninstall it using the command npm uninstall botmaker-cli to protect your system from potential threats.
