grammy

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (knorpelsenf) on 2026-07-16, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/4cb8e68d52e95f2e7de9bc3fe619b03790a5e5af/out/context.js#L908 906 | } 907 | /** > 908 | * Context-aware alias for `api.getFile`. Use this method to get basic info about a file and prepare it for download 909 | * 910 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/4cb8e68d52e95f2e7de9bc3fe619b03790a5e5af/out/core/api.js#L501 499 | } 500 | /** > 501 | * Use this method to get basic info about a file and prepare it for downloading. For the moment, bots can download 502 | * 503 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/4cb8e68d52e95f2e7de9bc3fe619b03790a5e5af/out/core/client.js#L62 60 | } 61 | }; > 62 | const apiRoot = (_a = options.apiRoot) !== null && _a !== void 0 ? _a : "https://api.telegram.org"; 63 | const environment = (_b = options.environment) !== null && _b !== void 0 ? _b : "prod"; 64 | this.options = {

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/4cb8e68d52e95f2e7de9bc3fe619b03790a5e5af/out/web.mjs#L2216 2214 | } 2215 | }; > 2216 | const apiRoot = options.apiRoot ?? "https://api.telegram.org"; 2217 | const environment = options.environment ?? "prod"; 2218 | this.options = {

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/1305c990c759c6afe706aca36209615cac936a55/out/context.js#L908 906 | } 907 | /** > 908 | * Context-aware alias for `api.getFile`. Use this method to get basic info about a file and prepare it for download 909 | * 910 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/1305c990c759c6afe706aca36209615cac936a55/out/core/api.js#L501 499 | } 500 | /** > 501 | * Use this method to get basic info about a file and prepare it for downloading. For the moment, bots can download 502 | * 503 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/1305c990c759c6afe706aca36209615cac936a55/out/core/client.js#L62 60 | } 61 | }; > 62 | const apiRoot = (_a = options.apiRoot) !== null && _a !== void 0 ? _a : "https://api.telegram.org"; 63 | const environment = (_b = options.environment) !== null && _b !== void 0 ? _b : "prod"; 64 | this.options = {

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/1305c990c759c6afe706aca36209615cac936a55/out/web.mjs#L2216 2214 | } 2215 | }; > 2216 | const apiRoot = options.apiRoot ?? "https://api.telegram.org"; 2217 | const environment = options.environment ?? "prod"; 2218 | this.options = {

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/29de76de06915bac048ba121f77215f98f2581e4/out/context.js#L908 906 | } 907 | /** > 908 | * Context-aware alias for `api.getFile`. Use this method to get basic info about a file and prepare it for download 909 | * 910 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/grammyjs/grammY/blob/29de76de06915bac048ba121f77215f98f2581e4/out/core/api.js#L501 499 | } 500 | /** > 501 | * Use this method to get basic info about a file and prepare it for downloading. For the moment, bots can download 502 | * 503 | * Note: This function may not preserve the original file name and MIME type. You should save the file's MIME type a

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/29de76de06915bac048ba121f77215f98f2581e4/out/core/client.js#L62 60 | } 61 | }; > 62 | const apiRoot = (_a = options.apiRoot) !== null && _a !== void 0 ? _a : "https://api.telegram.org"; 63 | const environment = (_b = options.environment) !== null && _b !== void 0 ? _b : "prod"; 64 | this.options = {

URL pointing to known exfiltration/tunneling service Source: https://github.com/grammyjs/grammY/blob/29de76de06915bac048ba121f77215f98f2581e4/out/web.mjs#L2216 2214 | } 2215 | }; > 2216 | const apiRoot = options.apiRoot ?? "https://api.telegram.org"; 2217 | const environment = options.environment ?? "prod"; 2218 | this.options = {

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.