0e@0.0.109

a static rule a static pattern match (critical) flagged index.js for containing a Telegram bot token, chat_id, sendMessage endpoint, a console Proxy wrapper, and JSON.stringify — the canonical shape of a console-exfiltration stealer, matching the credential-regex-fingerprints pattern. The analysis found that hardcoded imgbb API key, Telegram bot token, hardcoded chat IDs, and Firebase realtime-DB writes, with a Proxy installed over the global console that ships log arguments to attacker-controlled Telegram and Firebase endpoints. While the analysis downgraded this to 'info' because index.js is not the declared main and is purportedly syntactically broken, shipping a weaponized exfiltration module inside an npm tarball is itself a supply-chain threat: (a) any downstream consumer or tool that imports by path would be exposed if the syntax issue is fixed or if only part of the file is consumed, (b) the presence of a working Telegram token + chat id + Firebase endpoint indicates deliberate malicious intent, not accident. Additionally, shows the actual entrypoint test.js performs an import-time HTTPS ESM self-import from cdn.skypack.dev and an unconditional fetch to a Cloudinary URL, which is unusual load-time network activity for a package with no described purpose. Combined signals: placeholder/meaningless package (name '0e'), import-time remote fetch in entrypoint, and a bundled credential-exfiltration module — consistent with an attacker-staged package rather than a benign library.