spotify-url-resolovela

{"modified":"2026-08-25T08:27:52Z","published":"2026-08-25T08:27:52Z","schema_version":"1.7.4","id":"MAL-2026-14487","summary":"Malicious code in spotify-url-resolovela (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045)\nOn require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules every 60 minutes. It archives the entire process.cwd() (excluding only node_modules and.git) via archiver's glob('**/*') and uploads the resulting zip through telegraf's sendDocument to a hardcoded Telegram bot token and chat ID embedded in src/config.js. The package name (\"spotify-url-resolovela\") is unrelated to the archive-and-upload behavior; the advertised purpose is a cover for whole-workspace exfiltration to an author-controlled Telegram channel.\n","affected":[{"package":{"ecosystem":"npm","name":"spotify-url-resolovela"},"versions":["3.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/BackupManager.js","sha256":"67490305a476692e887cdc254e7fd325cf0e1ede44660789367b66dcbae78e04","tlsh":"7d51230a6efe5131717b34de8fa7400a6026c0473816dedd3a9c93d89f8a42549a5ff4"},{"path":"src/config.js","sha256":"64d39d682b49f10705276cdab1fe99eaba4509e1a841ae3aa325b5793afdf508","tlsh":"1b01287a98f751a6112545d7e6af502b194c80133d22f835b78c89c04fdf25c4072efe"}],"package_integrity":[{"filename":"spotify-url-resolovela-3.4.2.tgz","hashes":{"sha1":"ce98248054c352acbf8b2bef4e92b94ba9c7b535","sha512_sri":"sha512-YesLIZq8VaUcPdUloeasJMDk+6irzAaDz1N2334tQ69Pk6+xqy0gotUxwcirSnaXTI+P08piw/6LckPWd2sSzA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/spotify-url-resolovela/v/3.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018729","import_time":"2026-08-25T08:49:17.680908885Z","modified_time":"2026-08-25T08:27:52Z","sha256":"93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045","source":"amazon-inspector","versions":["3.4.2"]}]}}