MAL-2026-16214

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791) The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop() at top level, which recursively archives the /root directory on Linux (or the drive root, typically C:\, on Windows) into a ZIP and uploads it via the Telegram Bot API to a hardcoded chat controlled by the package author. The loop repeats every hour and all errors are silently swallowed. The exclude list (node_modules,.git,.cache, tmp) does not exclude credential-bearing paths such as ~/.ssh, ~/.aws, ~/.npmrc,.env files, browser profiles, or wallet stores, so SSH keys, cloud credentials, source code, and other secrets under the archived root are shipped off-host. The Telegram bot token (8296271388:AAH-...) and chatId (8851479019) ship in cleartext in config.json and are the transport mechanism for the exfiltration; the destination is not caller-configurable. The package.json description ("Cross-platform automated server backup tool with Telegram delivery") self-labels the behavior but the package name and the silent auto-execution on require make this a covert exfiltration payload rather than an opt-in backup tool.