Malicious npm Packages Target Linux Developers Using Telegram Bot Libraries
A new and alarming supply chain attack has surfaced, aimed at Linux developers working with Telegram’s bot ecosystem.
First uncovered in early 2025, the attack involves several malicious npm packages posing as legitimate Telegram bot libraries. These packages are designed to implant SSH backdoors and exfiltrate sensitive data from unsuspecting developers.
Although these typosquatted packages amassed only around 300 downloads over several months, they represent a serious security threat. The attack centers on the popular node-telegram-bot-api library, which has been downloaded over 4.17 million times.
The malicious lookalike packages—node-telegram-utils, node-telegram-bots-api, and node-telegram-util—mimic the real library closely. They duplicate its documentation and functionality and even link to the genuine GitHub repository, which has over 19,000 stars, to lend false credibility.
Researchers at Socket.dev discovered that these malicious packages use a tactic known as “starjacking.” By setting their homepage to the legitimate project’s GitHub page, they inherit the trust and popularity of the real package, making them harder to distinguish at a glance.
Once installed on a Linux system, the packages quietly execute a function named addBotId() whenever the constructor is triggered. This function checks the platform, and if it detects Linux, it proceeds with its malicious payload—no user interaction required.
Infection Vector and Persistence
The core of this malware is an SSH backdoor. Upon execution, it silently modifies the victim’s ~/.ssh/authorized_keys file by adding attacker-controlled SSH keys. This ensures persistent remote access, even if the package is later removed.
