node-telegram-sockets@1.1.7

Summary

Package presents as a Telegram bot API client library (node-telegram-bot-api family). a static rule fired on keyword co-occurrence in lib/telegram.js and src/telegram.js (the literal token 'ping' on multiple lines, consistent with Telegram bot 'ping'-related API methods or test fixtures, not a child_process invocation of the ping command) and on lib/telegramWebHook.js / src/telegramWebHook.js for the combination of require('fs') + require('http') + require('https') + fs.readFileSync — the canonical shape of a webhook HTTPS server reading a TLS cert/key from disk (the readFileSync pair at adjacent lines is the standard cert+key load before https.createServer). No hardcoded attacker C2, no env-var scraping, no read of installer-secret paths (~/.aws, ~/.ssh, ~/.npmrc, browser profiles), no lifecycle scripts performing remote fetch+execute, no shell-history or messaging-session theft, and no install-time destructive action are evidenced. The static signals are pattern-matches on benign primitives (HTTPS webhook server, Telegram bot client methods); contextual code tracing did not run, so intent cannot be confirmed from the structured findings alone. Routing to human review per the default for empty the analysis + non-fingerprint static hits.

Source: amazon-inspector (222b22669330f75e779595b40bac9e2a842ef38fad691aaa46a0f4a615a55fc1)