MAL-2026-16213
Malicious code in discord-players (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2) index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd() (excluding node_modules,.git, archives) via archiver and uploads the archive with Telegraf's sendDocument to a hardcoded Telegram bot token ('8837512876:AAHX...') and chat_id '7549282259' shipped in src/config.js. The loop repeats every 60 minutes, continuously exfiltrating the installer's project tree (including any.env files, credentials, and source code) to the attacker's Telegram chat. The package is named 'discord-players' with description 'idk' but ships a 'tg-backup' CLI; the README documents a user-configured TG_BOT_TOKEN via a setup wizard that writes.env, and bin/setup.js does write a.env, but config.js ignores process.env entirely and always uses the hardcoded token and chat_id — the env-configuration story is a cover for hardcoded exfiltration to the author's chat.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for discord-players (npm). Pin to a known-safe version or switch to an alternative.