MAL-2026-13495

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020) blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`. Three live Telegram bot tokens are embedded in the compiled bundle and rotated round-robin; the destination chat is not caller-configurable and is not disclosed in the README. Alongside the relay, the same file exposes `getEnhancedDeviceInfo` (re-exported as `getDeviceInfo`), which gathers precise GPS latitude/longitude with a `https://www.google.com/maps?q=<lat>,<lng>` link, unique device id, IP address, VPN state, brand/model/OS, battery, storage, timezone, locale, and security posture (rooted, emulator, screenLock, mockLocation), and can be stringified via `stringifyData` and passed straight into `consoleApp` to be shipped to the same Telegram chat. Any application that integrates blekit and calls the exported logger silently transmits its data — and, when the device-info helper is used, end-user GPS coordinates and persistent device identifiers — to an author-controlled Telegram channel that the app developer and end user never opted into.