Package evidence

[email protected]

Webhook Exfil Endpoint: matched "api.telegram.org/bot"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 32,602Mainstream · −50% score
Versions published: 508Mature · −50% score
First published: Mar 2025
Publisher: shetty123
External confirmation: MAL-2026-3288OSV match · pinned to high regardless of other signals

Recommended action

Block this update

Static evidence trips multiple high-signal indicators. Quarantine the release until the publisher validates the change or you can rule out the indicators below.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["[email protected]"],"fail_on":"high"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["[email protected]"],"fail_on":"high"}'

Publishershetty123

Artifact bytes704,059

Previous version1.3.214

Published2026-06-06T18:46:04.736Z

SHA-2562f6e30beac4d6c52208ef46b684347f3e25c85277dad0fb176791ebb680873e2

Why flagged

What the scanner saw

Webhook Exfil Endpoint: matched "api.telegram.org/bot"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

high

7h agoLast checked

highRisk

27Score

1.3.216Version

Status history (1 event)

new → available7h ago · risk high · score 27 · status changed

Evidence

Static findings

4 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
high	Webhook Exfil Endpoint	package/dist/components/Telegram/Telegram.service.js	matched "api.telegram.org/bot"	40

Show all 4 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
high	Webhook Exfil Endpoint	package/dist/components/Telegram/Telegram.service.js	matched "api.telegram.org/bot"	40
low	Messenger Bot Endpoint	package/dist/components/bots/bots.service.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Messenger Bot Endpoint	package/dist/utils/ChannelLogger.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5
low	Messenger Bot Endpoint	package/dist/utils/logbots.js	matched "api.telegram.org/bot" — messenger-bot URL without exfil context (likely a notification handler)	5

Manifest

Package metadata

Scripts18

buildnest build
build:webpacknpm i --f && npm run webpack -- --config ./webpack-prod.config.ts
linteslint "{src,apps,libs,test}/**/*.ts" --fix
prebuildrimraf dist
prepublishOnlynpm run build
startcross-env nest start
start:debugnest start --debug --watch
start:devnest start --watch
start:prodnode dist/main
start:webpacknode dist/index.js
testjest
test:covjest --coverage
test:debugnode --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand
test:e2ejest --config ./test/jest-e2e.json
test:watchjest --watch
upload-cloudinarynode upload-build.js
webpackwebpack --mode development
webpack-devwebpack --watch --mode development

Dependencies21

@nestjs/common^11.1.13
@nestjs/config^4.0.3
@nestjs/core^11.1.13
@nestjs/mongoose^11.0.4
@nestjs/platform-express^11.1.13
@nestjs/swagger^11.2.6
adm-zip^0.5.16
axios^1.13.4
class-transformer^0.5.1
class-validator^0.14.3
cloudinary^2.9.0
https^1.0.0
imap^0.8.19
ioredis^5.9.2
mongoose^9.1.6
node-cache^5.1.2
rxjs^7.8.2
sharp^0.34.5
swagger-jsdoc^6.2.8
swagger-ui-express^5.0.1
telegram^2.26.22