discovered
Telegram account-takeover framework disguised as a NestJS Telegram service utility. All 502 published versions (1.0.1 through 1.3.207) are malicious. Sets a hardcoded 2FA password on managed accounts, polls operator IMAP for the confirmation code, evicts other authorized devices, and forwards OTP login codes from chat 777000 to operator-controlled Telegram bot channels. Pulls runtime config from npoint.io with committed plaintext credentials.