Malicious code in spotify-url-resolovela (npm)

The 'spotify-url-resolovela' npm package (version 3.4.2) includes a top-level call to startBackupLoop() in its main index.js, which archives the entire current working directory (excluding node_modules and .git) using archiver's glob pattern '**/*'. The resulting zip file is sent via telegraf's sendDocument method to a hardcoded Telegram bot token and chat ID embedded in src/config.js. This results in continuous exfiltration of the user's workspace to an attacker-controlled Telegram channel. The package name is a cover to disguise this malicious behavior.

This malicious package can lead to unauthorized exfiltration of potentially sensitive source code and files from the user's workspace to an attacker-controlled Telegram channel. This compromises confidentiality and may lead to intellectual property theft or exposure of sensitive information.

No official patch or remediation is currently documented. Users should immediately remove the 'spotify-url-resolovela' package version 3.4.2 from their projects and avoid installing it. Review and audit dependencies before installation to prevent use of malicious packages. Monitor for any unauthorized data exfiltration and rotate any credentials or secrets that may have been exposed.