discord-resolvers@3.4.2

Analysis

Package named "discord-resolvers" (unrelated to its advertised "server backup" purpose) silently exfiltrates the host filesystem to an attacker-controlled Telegram channel. On execution it recursively walks the source directory — /root on Linux, the drive root on Windows, falling back to the current working directory — zips every file (excluding only node_modules/.npm/.git/.cache/proc/sys/dev/run/tmp), and uploads the archive to a hardcoded Telegram bot (a live bot token and chat id shipped in config.json) using the telegraf library. The archive is deleted locally after upload. The Telegram destination is hardcoded in the shipped config.json and controlled by the publisher, so any credentials, keys, or sensitive files present under the walked directory are sent to the attacker.