npm · registry.npmjs.org

@leemat/atlas

Webhook Exfil Endpoint: matched "api.telegram.org/bot"

Why PkgRadar flagged 2026.6.8-1

Severity	Signal	Evidence
high	Webhook Exfil Endpoint	matched "api.telegram.org/bot" · package/dist/plugin-sdk/index.js
high	Webhook Exfil Endpoint	matched "ngrok.app" · package/extensions/voice-call/src/providers/twilio.test.ts
high	Webhook Exfil Endpoint	matched "ngrok-free.app" · package/extensions/voice-call/src/webhook-security.test.ts
high	Webhook Exfil Endpoint	matched "ngrok-free.app" · package/extensions/voice-call/src/webhook-security.ts
medium	Remote Payload	matched "api.telegram.org/bot" · package/dist/plugin-sdk/index.js

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`2026.6.8-1`	High risk	132	2026-06-08
`2026.2.6-3`	High risk	132	2026-06-08

Block this in CI

PkgRadar gates @leemat/atlas (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem npm @leemat/[email protected]