telegramxjm@1.0.1

Analysis

The package ships a FileSaver.js client-side library with an injected userscript beacon appended to the bundle. The injected code reads the running script's metadata and issues a GET request to hxxps://s[.]jtm[.]pub/api/sp/lib (with author/name/version/namespace/updateURL query parameters), then executes the response body via eval(), i.e. a remote code fetch-and-exec loader. It also maintains a daily request counter in persistent storage. The beacon is written against Greasemonkey/Tampermonkey userscript APIs (GM_xmlhttpRequest, GM_getValue, GM_setValue, GM_info).