MalwarePublished 7 Aug 2026Updated 10 Aug 2026

blekit (npm) · Malicious Code

Affects blekitSource GCVE Database

Malicious package : remove blekit and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13495

What to do

Remove blekit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmblekit	Affected =1.2.1 =1.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020) blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`. Three live Telegram bot tokens are embedded in the compiled bundle and rotated round-robin; the destination chat is not caller-configurable and is not disclosed in the README. Alongside the relay, the same file exposes `getEnhancedDeviceInfo` (re-exported as `getDeviceInfo`), which gathers precise GPS latitude/longitude with a `https://www.google.com/maps?q=<lat>,<lng>` link, unique device id, IP address, VPN state, brand/model/OS, battery, storage, timezone, locale, and security posture (rooted, emulator, screenLock, mockLocation), and can be stringified via `stringifyData` and passed straight into `consoleApp` to be shipped to the same Telegram chat. Any application that integrates blekit and calls the exported logger silently transmits its data — and, when the device-info helper is used, end-user GPS coordinates and persistent device identifiers — to an author-controlled Telegram channel that the app developer and end user never opted into. ## Source: ghsa-malware (f4213a76b2c5c574d5bfa41897a698d068ba56f146c88855eb2aeb2aac8ec9eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Applications integrating blekit versions 1.2.0 or 1.2.1 that invoke the logger or device info functions will unknowingly transmit sensitive user data, including precise GPS coordinates and unique device identifiers, to an attacker-controlled Telegram channel. This compromises user privacy and may facilitate tracking or further attacks. The exfiltration is silent and not disclosed to developers or end users, increasing the risk of unnoticed data leakage.

Defensive guidance

Users and developers should immediately discontinue use of blekit versions 1.2.0 and 1.2.1. Review application dependencies for blekit and remove or replace it with a trusted alternative. Monitor for updates from the package maintainer or npm advisories for any official fixes. Until a fix is available, avoid calling the logger or device info functions to prevent data exfiltration.

Summary

The blekit package (versions 1.2.0 and 1.2.1) includes a logger module that posts any logged string to a Telegram bot endpoint with hardcoded tokens and a fixed chat ID, sending data to an attacker-controlled Telegram channel. Additionally, a device info function collects precise GPS location and extensive device metadata, which can be sent through the logger to the same channel. This behavior is undocumented and not configurable by the integrating application, resulting in silent exfiltration of sensitive user data including location and persistent device identifiers.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:21 UTC

Technical details

References

Community reviews