blekit@1.2.1: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 8d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13495 confirms this npm version as malicious. blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`...

Advisory

MAL-2026-13495

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in blekit (npm)

Details

blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`. Three live Telegram bot tokens are embedded in the compiled bundle and rotated round-robin; the destination chat is not caller-configurable and is not disclosed in the README. Alongside the relay, the same file exposes `getEnhancedDeviceInfo` (re-exported as `getDeviceInfo`), which gathers precise GPS latitude/longitude with a `https://www.google.com/maps?q=<lat>,<lng>` link, unique device id, IP address, VPN state, brand/model/OS, battery, storage, timezone, locale, and security posture (rooted, emulator, screenLock, mockLocation), and can be stringified via `stringifyData` and passed straight into `consoleApp` to be shipped to the same Telegram chat. Any application that integrates blekit and calls the exported logger silently transmits its data — and, when the device-info helper is used, end-user GPS coordinates and persistent device identifiers — to an author-controlled Telegram channel that the app developer and end user never opted into.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 22 file(s), 400 KB of source, external domains: api.telegram.org, schemas.android.com, www.google.com

Source & flagged code

3 flagged

dist/index.jsView file

50isConnected: () => isConnected, L51: monitorData: () => monitorData, L52: monitorHealthMetrics: () => monitorHealthMetrics, ... L86: const batteryState = await Battery.getBatteryStateAsync(); L87: const net = await import_netinfo.default.fetch(); L88: let latitude = null; ... L112: const totalStorage = await import_react_native_device_info.default.getTotalDiskCapacity(); L113: const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; L114: const locale = Device.osName === "iOS" ? Intl.DateTimeFormat().resolvedOptions().locale : legacyDeviceInfo.getDeviceLocale?.() ?? "en-US"; ... L291: }); L292: const data = await response.json(); L293: return data.ok === true;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L50

50Trigger-reachable chain: manifest.main -> dist/index.js L50: isConnected: () => isConnected, L51: monitorData: () => monitorData, L52: monitorHealthMetrics: () => monitorHealthMetrics, ... L86: const batteryState = await Battery.getBatteryStateAsync(); L87: const net = await import_netinfo.default.fetch(); L88: let latitude = null; ... L112: const totalStorage = await import_react_native_device_info.default.getTotalDiskCapacity(); L113: const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; L114: const locale = Device.osName === "iOS" ? Intl.DateTimeFormat().resolvedOptions().locale : legacyDeviceInfo.getDeviceLocale?.() ?? "en-US"; ... L291: }); L292: const data = await response.json(); L293: return data.ok === true;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L50

50Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js L50: isConnected: () => isConnected, L51: monitorData: () => monitorData, L52: monitorHealthMetrics: () => monitorHealthMetrics, ... L86: const batteryState = await Battery.getBatteryStateAsync(); L87: const net = await import_netinfo.default.fetch(); L88: let latitude = null; ... L112: const totalStorage = await import_react_native_device_info.default.getTotalDiskCapacity(); L113: const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; L114: const locale = Device.osName === "iOS" ? Intl.DateTimeFormat().resolvedOptions().locale : legacyDeviceInfo.getDeviceLocale?.() ?? "en-US"; ... L291: }); L292: const data = await response.json(); L293: return data.ok === true;

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/index.jsView on unpkg · L50

Source & flagged code

3 flagged · loading source

dist/index.jsView file

50isConnected: () => isConnected, L51: monitorData: () => monitorData, L52: monitorHealthMetrics: () => monitorHealthMetrics, ... L86: const batteryState = await Battery.getBatteryStateAsync(); L87: const net = await import_netinfo.default.fetch(); L88: let latitude = null; ... L112: const totalStorage = await import_react_native_device_info.default.getTotalDiskCapacity(); L113: const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; L114: const locale = Device.osName === "iOS" ? Intl.DateTimeFormat().resolvedOptions().locale : legacyDeviceInfo.getDeviceLocale?.() ?? "en-US"; ... L291: }); L292: const data = await response.json(); L293: return data.ok === true;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L50

50Trigger-reachable chain: manifest.main -> dist/index.js L50: isConnected: () => isConnected, L51: monitorData: () => monitorData, L52: monitorHealthMetrics: () => monitorHealthMetrics, ... L86: const batteryState = await Battery.getBatteryStateAsync(); L87: const net = await import_netinfo.default.fetch(); L88: let latitude = null; ... L112: const totalStorage = await import_react_native_device_info.default.getTotalDiskCapacity(); L113: const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; L114: const locale = Device.osName === "iOS" ? Intl.DateTimeFormat().resolvedOptions().locale : legacyDeviceInfo.getDeviceLocale?.() ?? "en-US"; ... L291: }); L292: const data = await response.json(); L293: return data.ok === true;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

2 Critical1 High3 Medium3 Low

CriticalCredential Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings