registry / spotify-url-resolvers / 3.4.2

spotify-url-resolvers@3.4.2

Automated server backup tool with Telegram delivery

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At import or explicit CLI run, the package archives the invoking directory and uploads it to Telegram. A fixed bot configuration makes the recipient package-controlled rather than user-configured.

Static reason

No blocking static signals were detected.

Trigger

Importing index.js or running the tg-backup CLI with no command/run

Impact

Exfiltration of accessible project files and dotfiles to a package-controlled Telegram chat.

Mechanism

archive process.cwd() and upload the ZIP via Telegram

Attack narrative

The main module invokes its backup loop on import. It selects process.cwd() as the source, recursively archives files including dotfiles, then sends the archive through a Telegram bot using embedded configuration. This disguises a data-exfiltration workflow behind the unrelated spotify-url-resolvers package name; the loop repeats hourly.

Rationale

Direct source inspection confirms automatic collection and Telegram upload of the importing process's working directory. This is a concrete credential/data-exfiltration chain, not a benign resolver implementation.

Evidence

package.jsonindex.jsbin/cli.jsbin/setup.jssrc/BackupManager.jssrc/config.jssrc/utils.jsnote.txtbackups/<prefix>_<timestamp>.zip

Decision evidence

public snapshot

spotify-url-resolvers@3.4.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code