@velliajs/telegram@1.0.0

Analysis

@velliajs/telegram@1.0.0 is a trojanized clone of the telegraf Telegram bot framework. The package ships a hardcoded GitHub personal access token in src/telegraf.ts and lib/telegraf.js. When the TraceCors.create() method is called, it fetches a remote JSON database from api[.]github[.]com/repos/Vellia-Elyvia/mydb/contents/db.json using the hardcoded token, and checks whether the bot's username is registered and active. If the bot is not registered, the library throws an error and refuses to operate — a remote authorization gate / kill switch. This exfiltrates the bot's identity to the attacker's GitHub repository.