MAL-2026-14487
Malicious code in spotify-url-resolovela (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045) On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules every 60 minutes. It archives the entire process.cwd() (excluding only node_modules and.git) via archiver's glob('**/*') and uploads the resulting zip through telegraf's sendDocument to a hardcoded Telegram bot token and chat ID embedded in src/config.js. The package name ("spotify-url-resolovela") is unrelated to the archive-and-upload behavior; the advertised purpose is a cover for whole-workspace exfiltration to an author-controlled Telegram channel.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for spotify-url-resolovela (npm). Pin to a known-safe version or switch to an alternative.