MAL-2026-19151: Malicious code in carboniteapp (npm)
Malicious package. carboniteapp runs an install-time script (node index.js via its npm install hook) that collects host information, resolves the victim's public IP via api.ipify.org, and exfiltrates the collected data to an attacker-controlled Telegram bot (api.telegram.org). No legitimate functionality; the package exists solely to beacon/exfiltrate on install, so all published versions are malicious. Published 2026-05-06 and removed from npm the same day. Full context at the reference below.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package?
Any environment where carboniteapp was installed is exposed, because its install hook runs node index.js during npm installation. This can include developer workstations and build or CI environments that install npm dependencies.
What does the package collect and where does it send the data?
It collects host information, obtains the victim's public IP address from api.ipify.org, and sends the collected data to an attacker-controlled Telegram bot through api.telegram.org.
Are any versions safe to use?
No. The available data states that all published versions are malicious and that the package has no legitimate functionality.
How can I determine whether an environment was affected?
Check npm dependency manifests, lockfiles, installation logs, and CI build records for carboniteapp. Also review network telemetry from the time of installation for requests to api.ipify.org and api.telegram.org.
What should be done if the package was installed?
Remove carboniteapp from dependencies and prevent it from being installed again. Treat affected hosts and CI environments as potentially exposed because host information and public IP data may have been exfiltrated during installation.