Loading npm security reports…
[](https://www.npmjs.com/package/paperclip-plugin-telegram) [](https://opensource.org/licenses/MIT)
Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
dist/constants.js enables commands/inbound access with empty allowlists by default.
dist/constants.jsView on unpkgdist/allowlist.js treats two empty allowlists as authorization for every Telegram update.
package.jsonView on unpkgdist/commands.js lets any allowed sender list companies and link their chat via /connect.
dist/commands.jsView on unpkgdist/commands.js exposes issue creation and approval mutations to linked chats.
dist/commands.jsView on unpkgdist/command-registry.js permits Telegram-imported workflows with arbitrary ctx.http.fetch URLs.
dist/command-registry.jsView on unpkgdist/worker.js starts long polling after a configured bot token resolves.
dist/worker.jsView on unpkgdist/constants.js enables commands/inbound access with empty allowlists by default.
dist/constants.jsView on unpkgdist/allowlist.js treats two empty allowlists as authorization for every Telegram update.
package.jsonView on unpkg · L36dist/commands.js lets any allowed sender list companies and link their chat via /connect.
dist/commands.jsView on unpkgdist/commands.js exposes issue creation and approval mutations to linked chats.
dist/commands.jsView on unpkgdist/command-registry.js permits Telegram-imported workflows with arbitrary ctx.http.fetch URLs.
dist/command-registry.jsView on unpkgdist/worker.js starts long polling after a configured bot token resolves.
dist/worker.jsView on unpkg