discord-players@3.4.2

Analysis

discord-players@3.4.2 is a Telegram-based data exfiltration tool disguised as a Discord package. On require, it zips the entire current working directory (including .env, source, and config files) and uploads the archive to a hardcoded Telegram chat via a hardcoded bot token. The bundled note.txt instructs the attacker to require() the package from their code, at which point it silently copies all host files and sends them to Telegram. The zip is created from process.cwd() with dot:true (includes hidden files) and sent through the Telegram Bot API to a hardcoded chat ID.