log-input@1.0.5

Analysis

log-input@1.0.5 is a data-exfiltration module disguised as a logging library. Its index.js exports a prompt() function that reads stdin and a parse() function that POSTs the captured input to a hardcoded Telegram bot endpoint (api.telegram[.]org/bot<token>/sendMessage?chat_id=5737666369&text=...); the base64-encoded C2 URL decodes to send captured text to an attacker-controlled Telegram channel. There is no lifecycle hook — it exfiltrates when imported and called. The README even admits 'IT CAN LEAK YOUR DATA'.