registry / Malware / stella-coder

stella-coder

Stella Coder 5.0 — AI coding agent with Telegram bot, huge context, TDD, Git ecosystem, presentations, computer control, smart home, Office automation, and antivirus

This report shows the evidence for stella-coder@5.3.6. 13 of 15 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10134 confirms this npm version as malicious.

Advisory

MAL-2026-10134

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in stella-coder (npm)

Details

stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token (BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0") that is controlled by the package author. When the user invokes the /tg CLI command, the package starts a Telegram bot on the installer's machine that receives messages over api.telegram.org and passes them into execSync(`node stella-cli/index.mjs -p "${text}"`), invoking a shell-capable AI agent CLI with attacker-supplied input. Because the messaging channel is bound to a token the author retains, the author observes all bot traffic — including the 4-digit admin authorization code exchanged over that same channel — and can replay it to reach the command-execution path on any installer that enables /tg. telegram-bot.mjs additionally sends os.hostname() and os.userInfo().username to the same author-controlled bot. A hardcoded PREMIUM_CODE = "10102013" acts as a universal activation key that unlocks the remote-control feature-set without payment. package.json sets "main": "stella-cli/index.mjs", whose top-level executes main() and starts the interactive CLI on require/import, extending the reach of the /tg surface beyond the bin entry. There are no install lifecycle hooks; the backdoor fires when the user runs the CLI (or a consumer imports the module) and invokes /tg.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Source confirms a user-invoked but unsafe remote-control capability rather than install-time malware. The hard-coded shared Telegram credential and shell interpolation warrant a warning.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs `/tg`, authorizes a Telegram account locally, then sends a bot message.

Impact

An authorized or compromised Telegram account can obtain arbitrary command execution and receive resulting output.

Mechanism

Authenticated Telegram input is shell-interpolated into a CLI invocation.

AI rationale

Source confirms a user-invoked but unsafe remote-control capability rather than install-time malware. The hard-coded shared Telegram credential and shell interpolation warrant a warning.

Evidence

package.jsonstella-cli/index.mjsstella-cli/telegram-bot.mjs

Network endpoints1

api.telegram.org

Independent scan evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

`stella-cli/telegram-bot.mjs` embeds a Telegram bot credential and polls `api.telegram.org`.
`stella-cli/index.mjs` exposes bot startup only through the explicit `/tg` command.
Authenticated Telegram text is interpolated into an `execSync` shell command in `stella-cli/telegram-bot.mjs`.
Command output is sent back to the Telegram chat, enabling remote command-result disclosure.
The bot persists authorization and session state under its own `.stella` configuration directory.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` hook.
Telegram polling begins only after the user runs `/tg`.
Remote command handling checks a locally stored authorized-user list before execution.
No source evidence found of automatic environment-variable or credential-file harvesting.
No foreign AI-agent configuration mutation was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

19 flagged

releases/stella-antivirus/scanner.mjsView file

Lines 1-22javascript

1import fs from "node:fs"

2import path from "node:path"

3import { execSync } from "node:child_process"

4import { checkFileForMalware, computeFileHash, SKIP_DIRS, QUICK_SCAN_PATHS, QUARANTINE_DIR, isExcluded } from "./database.mjs"

High

Child Process

Package source references child process execution.

releases/stella-antivirus/scanner.mjsView on unpkg · L2

6// ═══════════════════════════════════════════════════════════════

7// STELLAR ANTIVIRUS — Full Scanner Engine

8// ═══════════════════════════════════════════════════════════════

10const SCAN_EXTENSIONS = new Set([

11 ".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx",

12 ".py", ".rb", ".php", ".pl", ".sh", ".bash",

13 ".bat", ".cmd", ".ps1", ".psm1", ".psd1",

14 ".exe", ".dll", ".sys", ".com", ".scr", ".pif",

15 ".vbs", ".vbe", ".jse", ".wsf", ".wsh",

16 ".hta", ".cpl", ".msi", ".msp", ".mst",

17 ".doc", ".docm", ".xls", ".xlsm", ".ppt", ".pptm",

18 ".pdf", ".rtf",

19 ".jar", ".class", ".war",

20 ".reg", ".inf",

21])

Lines 316-356javascript

316// ═══════════════════════════════════════════════════════════════

317

318export function scanRunningProcesses() {

319 const results = []

320

321 // Known safe Windows processes

322 const SAFE_PROCESSES =

dist/tools.mjsView file

Lines 325-365javascript

325 inputSchema: z.object({ path: z.string() }),

326 execute: async ({ path: p }) => {

327 const abs = resolveSafe

releases/stella-antivirus/database.mjsView file

Lines 145-185javascript

145 // ══════ EXPLOITS ══════

146 { id: "SIG-031", name: "Metasploit стейджинг", severity: "critical", category: "exploit",

147 pattern: /msfvenom[\s\S]{0,100}

dist/index.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.3.0 matchedPath = dist/index.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

6import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6

releases/stella-coder/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync }

releases/stella-coder/build.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Stella Coder — Build Script (SEA: Single Executable Application)

3import fs from "node:fs"

4import path from "node:path"

5import { execSync } from "node:child_process"

6import { fileURLToPath } from

stella-cli/telegram-bot.mjsView file

Lines 1-24javascript

1import fs from "node:fs"

2import path from "node:path"

3import os from "node:os"

4import crypto from "node:crypto"

5import { execSync } from

releases/stella-coder/coding-brain.mjsView file

639try { L640: const output = execSync(checker.cmd, { cwd, encoding: "utf8", timeout: 120000 }) L641: return { success: true, output, hasErrors: false } ... L650: const testCmds = { L651: jest: "npx jest --passWithNoTests", L652: vitest: "npx vitest run",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

releases/stella-coder/coding-brain.mjsView on unpkg · L639

run-antivirus.batView file

•path = run-antivirus.bat kind = build_helper sizeBytes = 66 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-antivirus.batView on unpkg

releases/stella-antivirus.zipView file

•path = releases/stella-antivirus.zip kind = high_entropy_blob sizeBytes = 22900 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

releases/stella-antivirus.zipView on unpkg

•path = releases/stella-antivirus.zip kind = compressed_blob sizeBytes = 22900 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

releases/stella-antivirus.zipView on unpkg

•path = releases/stella-antivirus.zip kind = nested_archive_needs_inspection sizeBytes = 22900 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

releases/stella-antivirus.zipView on unpkg

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file

•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg

antimalware/database.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.3.0 matchedPath = antimalware/database.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

antimalware/database.mjsView on unpkg

dist/antimalware/database.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/antimalware/database.mjsView on unpkg

Source & flagged code

19 flagged · loading source

releases/stella-antivirus/scanner.mjsView file

2import path from "node:path" L3: import { execSync } from "node:child_process" L4: import { checkFileForMalware, computeFileHash, SKIP_DIRS, QUICK_SCAN_PATHS, QUARANTINE_DIR, isExcluded } from "./database.mjs"

High

Child Process

Package source references child process execution.

releases/stella-antivirus/scanner.mjsView on unpkg · L2

336"ollama.exe", "ollama_llama_server.exe", L337: "powershell.exe", "pwsh.exe", "cmd.exe", L338: "WindowsTerminal.exe", "wt.exe",

High

Shell

Package source references shell execution.

releases/stella-antivirus/scanner.mjsView on unpkg · L336

dist/tools.mjsView file

•matchType = normalized_sha256 matchedPackage = stella-coder@5.3.0 matchedPath = dist/tools.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

2 Critical11 High7 Medium6 Low

CriticalCredential Exfiltrationreleases/stella-coder/telegram-bot.mjs

CriticalTrigger Reachable Dangerous Capabilitystella-cli/telegram-bot.mjs

HighChild Processreleases/stella-antivirus/scanner.mjs

HighShellreleases/stella-antivirus/scanner.mjs

HighCross File Remote Execution Contextreleases/stella-coder/build.mjs

HighRuntime Package Installreleases/stella-coder/coding-brain.mjs

HighShips High Entropy Blobreleases/stella-antivirus.zip

HighPayload In Excluded Dir.opencode/skills/ui-ux-pro-max/scripts/design_system.py

HighKnown Malware Source Similarityantimalware/database.mjs

HighKnown Malware Source Similaritydist/antimalware/database.mjs

Affected versions and remediation

This report applies to stella-coder@5.3.6.

The versions list below shows the verdict for each recorded version.

Avoid installing stella-coder@5.3.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-14 07:45:08.269Z (UTC).

Source advisory published: 2026-07-10 15:59:07.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

15 known versions

5.3.6latestshownMaliciousMalwareBlockPublishedJul 13, 2026, 10:04 PM 5.3.5MaliciousMalwareBlockPublishedJul 13, 2026, 9:26 PM 5.3.4MaliciousMalwareBlockPublishedJul 13, 2026, 8:37 PM 5.3.3MaliciousMalwareBlockPublishedJul 13, 2026, 8:26 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code