OpenSSF/OSV advisory MAL-2026-14487 confirms this npm version as malicious. On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules every 60 minutes. It archives the entire process.cwd() (excluding only node_modules and.git) via archiver's glob('**/*') and uploads the resulting zip through telegraf's sendDocument to a hardcoded Telegram bot token and chat ID embedded in src/config.js...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in spotify-url-resolovela (npm)
Details
On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules every 60 minutes. It archives the entire process.cwd() (excluding only node_modules and.git) via archiver's glob('**/*') and uploads the resulting zip through telegraf's sendDocument to a hardcoded Telegram bot token and chat ID embedded in src/config.js. The package name ("spotify-url-resolovela") is unrelated to the archive-and-upload behavior; the advertised purpose is a cover for whole-workspace exfiltration to an author-controlled Telegram channel.
Decision reason
OpenSSF Malicious Packages via OSV confirms spotify-url-resolovela@3.4.2 as malicious (MAL-2026-14487): Malicious code in spotify-url-resolovela (npm)