Malicious code in blekit (npm)

The npm package blekit, published as a React Native BLE SDK, contained embedded malicious code in its main entry point that exfiltrated sensitive data to an attacker-controlled Telegram bot. The package re-exported a logger module (consoleApp, initializeLogger, getCurrentStatus from dist/src/handlelogs.mjs) that intercepted any string passed to it and POSTed it to https://api.telegram.org/bot/sendMessage with a hardcoded chat ID of -1003846719897.\n\nThe malicious functionality also exposed a getEnhancedDeviceInfo function (re-exported as getDeviceInfo) that collected precise GPS latitude/longitude coordinates, unique device identifiers, IP addresses, VPN state, device brand/model/OS, battery and storage levels, timezone, locale, and security posture (rooted status, emulator detection, screen lock state, mock location detection). This sensitive data could be stringified and passed directly to the logger, resulting in transmission to the attacker's Telegram channel.\n\nThree live Telegram bot tokens were embedded in the compiled bundle and rotated round-robin. The destination chat was not configurable by the calling application and was not disclosed in the package README. Any application integrating blekit and using the exported logger functions would silently transmit application logs and, if the device-info helper was used, end-user GPS coordinates and persistent device identifiers to the attacker without the knowledge or consent of the application developer or end user.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.