carboniteapp npm malware: install-script exfiltrates host data and public IP to attacker Telegram bot
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
The npm package carboniteapp is fully malicious: its install hook runs node index.js, which collects host information, resolves the victim's public IP via api.ipify.org, and exfiltrates the data to an attacker-controlled Telegram bot via api.telegram.org. The package has no legitimate functionality, so every published version (0) is affected and there is no patched version. It was published to npm on 2026-05-06 and removed the same day; the GitHub advisory (GHSA-cvmm-h8r9-4278, CWE-506) was published 2026-11-12. Any developer or CI environment that installed carboniteapp should treat the host as compromised and rotate exposed secrets.
What to do
- Search dependency locks, CI logs and node_modules history for any install of carboniteapp and remove it
- Treat machines/CI runners where it was installed as compromised; rotate credentials, tokens and keys accessible there
- Review egress logs for connections to api.ipify.org and api.telegram.org around install times
- Block those domains and audit other install scripts in the dependency tree
Sources
All live incidents on Threat Watch
