GCVE-110-OSM-2026-10999

This package is a data exfiltration tool masquerading as a Spotify URL library. The package description ('Automated server backup tool with Telegram delivery') reveals its true purpose: archiving the victim's current working directory and exfiltrating it via a hardcoded Telegram bot token (8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM) to chat ID 7549282259, controlled by actor @sadfsdfgdt. The src/config.js file explicitly sets sourceDir to process.cwd() and packages the filesystem into a zip archive sent over Telegram, with deleteAfterSend=true to destroy evidence. The publisher account is under a day old, published three similarly named packages (spotify-url-infos, spotify-url-resolovela, spotify-url-resolvers), and the package has no repository — all consistent with a hit-and-run typosquatting campaign targeting developers using the legitimate 'spotify-url-info' package. ENTRY bin/cli.js (bin: ./bin/cli.js) DESTINATION - 1 exfil (telegram-bot) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @tramadol19bot (id 8837512876) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @sadfsdfgdt