0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
spotify-url-resolver
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting spotify-url-resolver, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-5574 | Unknown | Malicious code in spotify-url-resolver (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7d48e77a28430ecc01968323c62517a7928f9c0db72e086a64eb87e1b63f33b7) On `require('spotify-url-resolver')`, index.js line 21 invokes startBackupLoop() at module top level. The loop zips process.cwd() (the installer's project root, including source code,.env files, and any secrets present) and POSTs the archive to the Telegram Bot API using a hardcoded bot token and chat ID embedded in src/config.js (bot 8951835797, chat 8494768763). The loop repeats every hour, providing persistent exfiltration for as long as |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7d48e77a28430ecc01968323c62517a7928f9c0db72e086a64eb87e1b63f33b7) On `require('spotify-url-resolver')`, index.js line 21 invokes startBackupLoop() at module top level. The loop zips process.cwd() (the installer's project root, including source code,.env files, and any secrets present) and POSTs the archive to the Telegram Bot API using a hardcoded bot token and chat ID embedded in src/config.js (bot 8951835797, chat 8494768763). The loop repeats every hour, providing persistent exfiltration for as long as