spotify-url-infos@3.4.2

Analysis

spotify-url-infos is a trojanized package whose name is unrelated to its function: it is a "server backup" tool that zips the current working directory (including hidden files such as .env) and uploads the archive to a hardcoded Telegram chat every hour. A Telegram bot token and chat ID are hardcoded in src/config.js, so the exfiltrated files (source code, credentials, secrets) are delivered to an attacker-controlled destination rather than the user. The upload runs automatically on start via index.js's hourly loop.