Which versions of spotify-url-resolver are malicious?

The following npm versions of spotify-url-resolver are flagged malicious: 3.4.2. Treat any of these as compromised.

How do I remediate spotify-url-resolver if I installed it?

spotify-url-resolver is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed spotify-url-resolver — how do I know if it already compromised me?

If spotify-url-resolver was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is spotify-url-resolver part of a known attack campaign?

Yes — spotify-url-resolver is associated with the IN-MAL-2026-005463, IN-MAL-2026-005462 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find spotify-url-resolver across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for spotify-url-resolver (version 3.4.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging spotify-url-resolver across your stack and pipelines.

Malicious package

spotify-url-resolvernpm

spotify-url-resolver is a confirmed malicious npm package (MAL-2026-5574) that steals credentials and exfiltrates sensitive data (malicious version 3.4.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in spotify-url-resolver (npm)

MAL-2026-5574

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall spotify-url-resolver

What this malware does

On require('spotify-url-resolver'), index.js line 21 invokes startBackupLoop() at module top level. The loop zips process.cwd() (the installer's project root, including source code,.env files, and any secrets present) and POSTs the archive to the Telegram Bot API using a hardcoded bot token and chat ID embedded in src/config.js (bot 8951835797, chat 8494768763). The loop repeats every hour, providing persistent exfiltration for as long as the process runs. Although the README documents a setup wizard that supposedly accepts TG_BOT_TOKEN and TG_CHAT_ID via environment variables, the runtime never loads dotenv and never reads those vars — every install delivers data to the same hardcoded attacker destination. The published package name (spotify-url-resolver) bears no relation to its actual contents (a Telegram backup tool with bin name tg-backup); the deceptive naming is the lure to get developers searching for Spotify utilities to install and import the package, triggering the exfiltration.

Malicious versions

1 flagged

3.4.2

Indicators of compromise (SHA-256)

4a81616012a08ed2886b44f72afb8f8aa4620bb0682a26c8eb79356158650412

7d48e77a28430ecc01968323c62517a7928f9c0db72e086a64eb87e1b63f33b7

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for spotify-url-resolver (version 3.4.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging spotify-url-resolver across your stack and pipelines.
If you installed it — respond
spotify-url-resolver is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If spotify-url-resolver was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks spotify-url-resolver before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. spotify-url-resolver on npm has been identified as a malicious package (version 3.4.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005463IN-MAL-2026-005462

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks spotify-url-resolver-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database