Malicious npm Packages Expose Nodejs Developers to Persistent SSH Backdoor Threats

A recent malicious campaign targeting the open-source Node.js community has shed light on a growing threat to Linux developers. This security breach, tied to typosquatted npm packages, has put developers at risk of unwittingly installing persistent SSH backdoors on their systems. These backdoors enable attackers to maintain long-term unauthorized access, even if the initial compromise is detected. The campaign specifically targeted developers working with Telegram bots by impersonating the widely trusted node-telegram-bot-api package, a core tool in Telegram bot development.

Summary

Security experts have identified a dangerous trend of typosquatting attacks within the npm ecosystem, particularly targeting the Telegram bot development community. Malicious packages such as node-telegram-utils, node-telegram-bots-api, and node-telegram-util were found to impersonate the legitimate node-telegram-bot-api package, which is widely used by developers to build Telegram bots.

The attack, which surfaced in early 2025, leveraged a clever deception. The malicious packages mirrored the legitimate Telegram bot package by copying its README documentation and linking back to the authentic GitHub repository. This impersonation created a false sense of trust, tricking developers into downloading and using the compromised code. Although the number of affected downloads (around 300) might seem relatively small, the impact is severe, as even a single compromise can provide attackers with an entry point into sensitive systems.

The core of the attack lies in the hidden functionality of the malicious packages. When installed on a Linux system, the backdoor code silently adds attacker-controlled SSH keys to the ~/.ssh/authorized_keys file. This allows attackers to gain passwordless, persistent access to the compromised machine. Additionally, the malware collects basic host data, such as the system’s external IP address and username, and exfiltrates this information to a remote command-and-control server.

What makes this attack particularly alarming is that it integrates seamlessly into existing Telegram bot logic, making detection incredibly difficult for developers reviewing package dependencies. Simply removing the malicious npm package does not undo the damage, as the injected SSH keys remain in place, allowing attackers to maintain access even after the package is deleted.

The broader consequences of such supply chain attacks are far-reaching. Attackers can leverage this initial access to move laterally across developer environments, exfiltrate data, or even execute arbitrary code. With the interconnected nature of modern software workflows, these compromises could escalate into significant breaches, affecting not only individual developers but also larger organizations and their production systems.

Given the popularity of Telegram and the bot-friendly nature of its API, it’s clear why the platform has become a prime target for these kinds of attacks. The decentralized nature of the npm ecosystem, combined with the absence of a centralized app store for Telegram bots, makes it particularly vulnerable to malicious actors.

To combat this ongoing threat, security experts recommend implementing thorough dependency audits and using automated tools to detect suspicious packages before they are integrated into development workflows. Solutions such as Socket’s GitHub app and CLI tool provide real-time monitoring of dependencies, offering developers an additional layer of protection against malicious code. These tools, when used in conjunction with browser-based security measures, can help prevent the accidental download or installation of harmful packages.

The attack underscores the importance of securing open-source software development practices. As supply chain attacks continue to evolve, it is vital for developers to remain vigilant, regularly monitor third-party dependencies, and take immediate action if any anomalous activity is detected in their environments.

What Undercode Say:

The recent wave of typosquatting and malicious npm packages targeting the Node.js community reveals a deeply concerning trend in the open-source ecosystem. The attackers’ use of familiar, trusted packages like node-telegram-bot-api to implant persistent backdoors is a clear indication of the evolving sophistication of supply chain threats. By targeting a widely used tool for Telegram bot development, attackers not only gain access to individual developer systems but also put entire production environments at risk.

The nature of this attack is particularly insidious due to its seamless integration into developers’ existing workflows. The malicious packages appear to be legitimate, with the README documentation and links to authentic GitHub repositories reinforcing their credibility. This deception plays into the hands of developers who, pressed for time, may overlook subtle red flags and blindly trust the integrity of these packages.

Moreover, the use of SSH keys to maintain persistent access to compromised systems adds an additional layer of complexity to remediation efforts. Even if the malicious package is removed from a project, the SSH keys remain active, providing attackers with continuous access. This highlights a critical vulnerability in current security practices within the open-source ecosystem, where developers may assume that removing a malicious dependency is sufficient to secure their systems.

The fact that these backdoor attacks were specifically aimed at Linux systems further underscores the importance of hardening the security of development environments. While the Linux operating system is often considered more secure than others, it remains a prime target for attackers due to its widespread use in server-side applications and developer workstations. In this case, the attackers exploited the convenience of passwordless SSH access, enabling them to maintain control over compromised systems without the need for constant authentication.

Another significant takeaway from this incident is the importance of dependency auditing in modern software development. The npm ecosystem, with its open and decentralized structure, is vulnerable to supply chain attacks because anyone can publish packages without significant oversight. While automated tools like Socket’s GitHub app can provide a first line of defense, manual vetting of dependencies remains crucial. Developers must become more proactive in reviewing the security of the packages they integrate into their projects.

This attack also illustrates a key challenge in securing the open-source ecosystem: the balance between convenience and security. As more developers turn to package managers like npm to streamline their workflows, the ease of integrating third-party packages can inadvertently introduce significant risks. The malicious actors behind this campaign exploited this very dynamic, knowing that developers would likely prioritize speed and functionality over thorough security checks.

Ultimately, this incident serves as a wake-up call for the open-source community. The threat landscape is evolving rapidly, and attackers are becoming more creative in their methods of compromise. It is imperative for developers, organizations, and the broader open-source ecosystem to invest in security tools and practices that can mitigate the risks of such attacks. With the right defenses in place, it is possible to continue benefiting from the power of open-source software without sacrificing security.

Fact Checker Results:

The attack targets Linux developers with malicious npm packages that deploy persistent SSH backdoors.
Attackers exploited a trusted Telegram bot package, deceiving developers with typosquatted versions.