registry  /  stella-coder  /  5.3.3

stella-coder@5.3.3

Stella Coder 5.0 — AI coding agent with Telegram bot, huge context, TDD, Git ecosystem, presentations, computer control, smart home, Office automation, and antivirus

AI Security Review

scanned 2h ago · by lpm-firewall-ai

An explicitly enabled Telegram bot exposes a remote control path for the local AI CLI. Its public hardcoded bot token makes that control channel and its messages depend on an unprotected shared credential.

Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source; source matched previously finalized malicious package; routed for review
Trigger
User starts Telegram support with `/tg` or runs `stella-cli/tg-bg.bat`.
Impact
Remote prompts can drive the local coding agent and return command output through Telegram; host fingerprint data is also handled by the bot.
Mechanism
Telegram long-polling forwards authenticated remote text into a local CLI subprocess.
Rationale
Source confirms a user-activated remote-control agent with a hardcoded third-party bot credential and local subprocess execution. No lifecycle hook or autonomous install-time malicious action was found, so the evidence supports warning rather than blocking.
Evidence
package.jsonstella-cli/telegram-bot.mjsstella-cli/index.mjsstella-cli/tg-server.mjsstella-cli/tg-bg.batreleases/stella-antivirus.zip~/.stella/telegram-auth.json~/.stella/sessions.json~/.stella/telegram-bot.json
Network endpoints1
api.telegram.org/bot${BOT_TOKEN}

OSV Corroboration

OpenSSF/OSV
Advisory
MAL-2026-10134
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in stella-coder (npm)
Details
stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token (BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0") that is controlled by the package author. When the user invokes the /tg CLI command, the package starts a Telegram bot on the installer's machine that receives messages over api.telegram.org and passes them into execSync(`node stella-cli/index.mjs -p "${text}"`), invoking a shell-capable AI agent CLI with attacker-supplied input. Because the messaging channel is bound to a token the author retains, the author observes all bot traffic — including the 4-digit admin authorization code exchanged over that same channel — and can replay it to reach the command-execution path on any installer that enables /tg. telegram-bot.mjs additionally sends os.hostname() and os.userInfo().username to the same author-controlled bot. A hardcoded PREMIUM_CODE = "10102013" acts as a universal activation key that unlocks the remote-control feature-set without payment. package.json sets "main": "stella-cli/index.mjs", whose top-level executes main() and starts the interactive CLI on require/import, extending the reach of the /tg surface beyond the bin entry. There are no install lifecycle hooks; the backdoor fires when the user runs the CLI (or a consumer imports the module) and invokes /tg.
References
OSV advisoryPACKAGEPACKAGEPACKAGEPACKAGEPACKAGEPACKAGEPACKAGE

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for block
  • `stella-cli/telegram-bot.mjs` hardcodes a Telegram bot token.
  • `startBot()` long-polls Telegram and handles remote messages.
  • Authenticated Telegram text is passed to `execSync` running `stella-cli/index.mjs -p`.
  • The bot collects host, network-interface, and Windows disk-serial data.
  • `stella-cli/tg-bg.bat` can launch the bot in background.
Evidence against
  • `package.json` has no preinstall, install, or postinstall hook.
  • Telegram control is activated by explicit `/tg` CLI use or supplied batch files.
  • Bot state is stored under the package-owned `~/.stella` directory.
  • No source-confirmed credential-file harvesting or unsolicited exfiltration was found.
  • `releases/stella-antivirus.zip` contains matching antivirus source, not an opaque executable payload.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 75 file(s), 1.85 MB of source, external domains: 127.0.0.1, a1x10.github.io, accounts.google.com, api-maps.yandex.ru, api.duckduckgo.com, api.github.com, api.telegram.org, cdn.jsdelivr.net, console.cloud.google.com, discord.gg, fonts.googleapis.com, geocode-maps.yandex.ru, github.com, gitlab.com, gmail.googleapis.com, html.duckduckgo.com, oauth2.googleapis.com, ollama.com, opencode.ai, static-maps.yandex.ru, www.google.com, www.googleapis.com, www.kinopoisk.ru, www.virustotal.com, www.w3.org, www.youtube.com

Source & flagged code

18 flagged · loading source
releases/stella-antivirus/scanner.mjsView file
2import path from "node:path" L3: import { execSync } from "node:child_process" L4: import { checkFileForMalware, computeFileHash, SKIP_DIRS, QUICK_SCAN_PATHS, QUARANTINE_DIR, isExcluded } from "./database.mjs"
High
Child Process

Package source references child process execution.

releases/stella-antivirus/scanner.mjsView on unpkg · L2
336"ollama.exe", "ollama_llama_server.exe", L337: "powershell.exe", "pwsh.exe", "cmd.exe", L338: "WindowsTerminal.exe", "wt.exe",
High
Shell

Package source references shell execution.

releases/stella-antivirus/scanner.mjsView on unpkg · L336
releases/stella-antivirus/database.mjsView file
165{ id: "SIG-037", name: "Service install", severity: "high", category: "privesc", L166: pattern: /CreateService[\s\S]{0,100}(SERVICE_AUTO_START|SERVICE_WIN32_OWN_PROCESS)[\s\S]{0,100}(cmd|powershell|bash)/ }, L167: ... L188: { id: "SIG-044", name: "Scheduled task", severity: "high", category: "persistence", L189: pattern: /schtasks[\s\S]{0,100}(\/create|\/Create)[\s\S]{0,100}(cmd|powershell|bash|python|perl)/ }, L190: ... L207: { id: "SIG-050", name: "DNS tunneling", severity: "high", category: "backdoor", L208: pattern: /DnsQuery[\s\S]{0,100}(TXT|MX|CNAME)[\s\S]{0,100}(encode|decode|base64)[\s\S]{0,100}(socket|connect)/ }, L209: ... L240: { id: "SIG-060", name: "HTTP POST exfil", severity: "high", category: "exfil", L241: pattern: /(fetch|XMLHttpRequest|axios|http\.request|request\()[\s\S]{0,200}(POST|PUT)[\s\S]{0,200}(password|token|secret|credential|cookie)/ }, L242:
Low
Weak Crypto

Package source references weak cryptographic algorithms.

releases/stella-antivirus/database.mjsView on unpkg · L165
dist/index.mjsView file
•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = dist/index.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg
6import os from "node:os" L7: import { execSync } from "node:child_process" L8: import { streamText, stepCountIs, generateText } from "ai" ... L22: const VERSION = "3.9.2" L23: const CONFIG_DIR = path.join(os.homedir(), ".stella") L24: const CONFIG_PATH = path.join(CONFIG_DIR, "config.json") ... L26: L27: const ZEN_BASE_URL = "https://opencode.ai/zen/v1" L28: ... L53: function loadConfig() { L54: try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")) } catch { return {} } L55: }
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.mjsView on unpkg · L6
releases/stella-coder/telegram-bot.mjsView file
4import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

releases/stella-coder/telegram-bot.mjsView on unpkg · L4
releases/stella-coder/build.mjsView file
4Cross-file remote execution chain: releases/stella-coder/build.mjs spawns releases/stella-coder/tools.mjs; helper contains network access plus dynamic code execution. L4: import path from "node:path" L5: import { execSync } from "node:child_process" L6: import { fileURLToPath } from "node:url" ... L8: const __filename = fileURLToPath(import.meta.url) L9: const __dirname = path.dirname(__filename) L10: ... L12: const SEA_BLOB = path.join(DIST, "sea-prep.blob") L13: const EXE_NAME = process.platform === "win32" ? "stella.exe" : "stella" L14: const OUTPUT = path.join(DIST, EXE_NAME)
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

releases/stella-coder/build.mjsView on unpkg · L4
stella-cli/telegram-bot.mjsView file
4Trigger-reachable chain: manifest.main -> stella-cli/index.mjs -> stella-cli/telegram-bot.mjs L4: import crypto from "node:crypto" L5: import { execSync } from "node:child_process" L6: ... L11: const BOT_TOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2_ebSi0" L12: const API_URL = `https://api.telegram.org/bot${BOT_TOKEN}` L13: const PREMIUM_CODE = "10102013" ... L15: L16: const CONFIG_DIR = path.join(os.homedir(), ".stella") L17: const BOT_CONFIG_PATH = path.join(CONFIG_DIR, "telegram-bot.json") ... L29: headers: { "Content-Type": "application/json" }, L30: body: JSON.stringify(body), L31: signal: AbortSignal.timeout(30000),
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

stella-cli/telegram-bot.mjsView on unpkg · L4
releases/stella-coder/coding-brain.mjsView file
639try { L640: const output = execSync(checker.cmd, { cwd, encoding: "utf8", timeout: 120000 }) L641: return { success: true, output, hasErrors: false } ... L650: const testCmds = { L651: jest: "npx jest --passWithNoTests", L652: vitest: "npx vitest run",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

releases/stella-coder/coding-brain.mjsView on unpkg · L639
run-antivirus.batView file
•path = run-antivirus.bat kind = build_helper sizeBytes = 66 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-antivirus.batView on unpkg
releases/stella-antivirus.zipView file
•path = releases/stella-antivirus.zip kind = high_entropy_blob sizeBytes = 22900 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

releases/stella-antivirus.zipView on unpkg
•path = releases/stella-antivirus.zip kind = compressed_blob sizeBytes = 22900 magicHex = [redacted]
Medium
Ships Compressed Blob

Package ships compressed or archive-like blobs.

releases/stella-antivirus.zipView on unpkg
•path = releases/stella-antivirus.zip kind = nested_archive_needs_inspection sizeBytes = 22900 magicHex = [redacted]
Low
Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

releases/stella-antivirus.zipView on unpkg
.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView file
•path = .opencode/skills/ui-ux-pro-max/scripts/design_system.py kind = payload_in_excluded_dir sizeBytes = 57424 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/ui-ux-pro-max/scripts/design_system.pyView on unpkg
releases/stella-coder/git-api.mjsView file
•matchType = previous_version_dangerous_delta matchedPackage = stella-coder@5.2.0 matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.0 similarity = 1.515 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

releases/stella-coder/git-api.mjsView on unpkg
antimalware/database.mjsView file
•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = antimalware/database.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

antimalware/database.mjsView on unpkg
dist/antimalware/database.mjsView file
•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = antimalware/database.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/antimalware/database.mjsView on unpkg
dist/tools.mjsView file
•matchType = normalized_sha256 matchedPackage = stella-coder@5.2.1 matchedPath = dist/tools.mjs matchedIdentity = npm:c3RlbGxhLWNvZGVy:5.2.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tools.mjsView on unpkg

Findings

3 Critical10 High6 Medium6 Low
CriticalCredential Exfiltrationreleases/stella-coder/telegram-bot.mjs
CriticalTrigger Reachable Dangerous Capabilitystella-cli/telegram-bot.mjs
CriticalPrevious Version Dangerous Deltareleases/stella-coder/git-api.mjs
HighChild Processreleases/stella-antivirus/scanner.mjs
HighShellreleases/stella-antivirus/scanner.mjs
HighCross File Remote Execution Contextreleases/stella-coder/build.mjs
HighRuntime Package Installreleases/stella-coder/coding-brain.mjs
HighShips High Entropy Blobreleases/stella-antivirus.zip
HighPayload In Excluded Dir.opencode/skills/ui-ux-pro-max/scripts/design_system.py
HighKnown Malware Source Similarityantimalware/database.mjs
HighKnown Malware Source Similaritydist/antimalware/database.mjs
HighKnown Malware Source Similaritydist/index.mjs
HighKnown Malware Source Similaritydist/tools.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.mjs
MediumShips Build Helperrun-antivirus.bat
MediumShips Compressed Blobreleases/stella-antivirus.zip
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoreleases/stella-antivirus/database.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionreleases/stella-antivirus.zip