The stella-coder npm package contains a backdoor implemented via a hardcoded Telegram bot API token. This token allows the package author to control a Telegram bot running on the installer's machine. When the user runs the /tg CLI command, the bot receives messages from the attacker and executes them as shell commands through a node subprocess. The attacker can intercept and replay an admin authorization code to gain command execution on any machine running the package with the /tg feature enabled. Additionally, the package leaks system information (hostname and username) to the attacker. The malicious code is triggered by running the CLI or importing the module and invoking /tg. A hardcoded universal activation key bypasses payment requirements for the remote control feature. The affected versions are explicitly 4.0.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, and 5.1.2. No patch or fix is currently documented.

This malicious package enables remote code execution on the installer's machine via a Telegram bot controlled by the package author. The attacker can execute arbitrary shell commands, potentially compromising the entire system. Sensitive information such as hostname and username is exfiltrated to the attacker. The presence of a universal activation key allows the attacker to activate the backdoor without payment. This represents a severe compromise of confidentiality, integrity, and availability for users who run the /tg command or import the module and invoke this functionality.

No official patch or remediation guidance is currently available. Users should immediately discontinue use of the affected stella-coder versions (4.0.0, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.1.2) and remove the package from their environments. Avoid running the /tg CLI command or importing the module in a way that triggers this functionality. Monitor for any updates from the package author or npm registry for potential fixes or removal of the malicious code. Consider using trusted alternatives and verifying package integrity before installation.