GCVE-110-OSM-2026-12214

index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd() (excluding node_modules,.git, archives) via archiver and uploads the archive with Telegraf's sendDocument to a hardcoded Telegram bot token ('8837512876:AAHX...') and chat_id '7549282259' shipped in src/config.js. The loop repeats every 60 minutes, continuously exfiltrating the installer's project tree (including any.env files, credentials, and source code) to the attacker's Telegram chat. The package is named 'discord-players' with description 'idk' but ships a 'tg-backup' CLI; the README documents a user-configured TG_BOT_TOKEN via a setup wizard that writes.env, and bin/setup.js does write a.env, but config.js ignores process.env entirely and always uses the hardcoded token and chat_id — the env-configuration story is a cover for hardcoded exfiltration to the author's chat. ENTRY bin/cli.js (bin: ./bin/cli.js) DESTINATION - 2 exfil (telegram-bot) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Very New NPM Publisher Account TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @tramadol19bot (id 8837512876)