spotify-url-resolvers@3.4.2

Analysis

spotify-url-resolvers is a trojanized package that exfiltrates the installer's project directory to an attacker-controlled Telegram account. When the package is required (index.js runs on require), it zips the entire current working directory — including hidden files such as .env and config — and uploads the archive to Telegram via a hardcoded attacker bot token and chat ID (api[.]telegram[.]org). The package is named after Spotify URL resolution but contains no such functionality; its bundled note.txt instructs victims to add `require('spotify-url-resolvers')` to their code to have "a copy of all the host files" sent to Telegram. Exfiltration target is the Telegram Bot API.