autotel-mongoose@6.0.1
Malicious code in autotel-mongoose (npm)
T1140 · Deobfuscate/Decode Files or InformationT1027 · Obfuscated Files or Information
Analysis
This version is part of a supply-chain compromise of the autotel publisher pipeline. The package ships a ~4.5MB index.js containing a ROT-cipher eval decoder that injects and executes a hidden payload on module import (require-time) — no install hook is needed. The affected releases were later deprecated with the note "SECURITY: compromised supply-chain build."
- analyzed by
- Leitwacht
- first seen
- Jun 7, 2026, 07:19 PM
- analyzed
- Jun 7, 2026, 07:26 PM
- weekly installs
- 1,176
Related advisories
- autotel-mongoose@2.0.5 same package
- autotel-mongoose@3.0.1 same package
- autotel-mongoose@4.0.1 same package
- autotel-mongoose@5.0.2 same package
- autotel-mongoose@1.0.2 same package
- autotel-mcp@3.0.1
- autotel-mcp@5.0.1
- autotel-mcp@8.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.