Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Published on April 19, 2025

Cybersecurity researchers have uncovered three malicious packages in the npm registry that masquerade as a popular Telegram bot library but harbor SSH backdoors and data exfiltration capabilities. The packages in question are listed below - node-telegram-utils (132 downloads) node-telegram-bots-api (82 downloads) node-telegram-util (73 downloads) According to supply chain

Continue reading on website
Other news

Critical Erlang/OTP SSH RCE bug now has public exploits, patch now

April 19, 2025
Public exploits are now available for a critical Erlang/OTP SSH vulnerability tracked as CVE-2025-32433, allowing unauthenticated attackers to remotely execute code on impacted devices. [...]

New Android malware steals your credit cards for NFC relay attacks

April 19, 2025
A new malware-as-a-service (MaaS) platform named 'SuperCard X' has emerged, targeting Android devices via NFC relay attacks that enable point-of-sale and ATM transactions using compromised payment card data. [...]