spotify-url-resolovela @3.4.2

Summary

On require()/import of the package's main index.js, a top-level startBackupLoop() call runs immediately and reschedules every 60 minutes. It archives the entire process.cwd() (excluding only node_modules and.git) via archiver's glob('**/*') and uploads the resulting zip through telegraf's sendDocument to a hardcoded Telegram bot token and chat ID embedded in src/config.js. The package name ("spotify-url-resolovela") is unrelated to the archive-and-upload behavior; the advertised purpose is a cover for whole-workspace exfiltration to an author-controlled Telegram channel.

Source: amazon-inspector (93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045)