← Home

node-telegram-bot-api

npm Repository Homepage
11
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

gochomugoyagop

Keywords

telegramtelegram bottelegram bot apibottypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:request AI (dependencies): Widely-used legacy HTTP client, not malicious; standard dep for this old package version. ai
semgrep semgrep:shady-links-exfil-services AI (semgrep): Match is api.telegram.org in a doc comment — the package's own API base URL, not exfil. ai
source-diff obfuscated-file:dist/telegram.d.cts AI (source-diff): Generated TypeScript declaration file with long type-import lines; not obfuscation. ai
source-diff large-new-source-files AI (source-diff): TypeScript rewrite producing dual CJS/ESM dist output; expected for this package's evolution. ai

Versions (showing 11 of 11)

Version Deps Published
1.2.0 0 / 4
1.1.2 0 / 4
1.1.1 0 / 3
1.1.0 0 / 3
1.0.0 0 / 3
0.66.0 9 / 22
0.65.1 9 / 22
0.65.0 9 / 22
0.64.0 9 / 22
0.26.0 10 / 21
0.1.0 3 / 5

v1.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.66.0

5 findings
HIGH shady-links-exfil-services: lib/telegram.js:118 semgrep

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/yagop/node-telegram-bot-api/blob/65ef0a2fcccf96e1823b76654ffc909347f5876b/lib/telegram.js#L118 116 | * @param {Object} [options.request] Options which will be added for all requests to telegram api. 117 | * See https://github.com/request/request#requestoptions-callback for more information. > 118 | * @param {String} [options.baseApiUrl="https://api.telegram.org"] API Base URl; useful for proxying and testing 119 | * @param {Boolean} [options.filepath=true] Allow passing file-paths as arguments when sending files, 120 | * such as photos using `TelegramBot#sendPhoto()`. See [usage information][usage-sending-files-performance]

HIGH shady-links-exfil-services: lib/telegram.js:163 semgrep

URL pointing to known exfiltration/tunneling service Source: https://github.com/yagop/node-telegram-bot-api/blob/65ef0a2fcccf96e1823b76654ffc909347f5876b/lib/telegram.js#L163 161 | _this.options.polling = typeof options.polling === 'undefined' ? false : options.polling; 162 | _this.options.webHook = typeof options.webHook === 'undefined' ? false : options.webHook; > 163 | _this.options.baseApiUrl = options.baseApiUrl || 'https://api.telegram.org'; 164 | _this.options.filepath = typeof options.filepath === 'undefined' ? true : options.filepath; 165 | _this.options.badRejection = typeof options.badRejection === 'undefined' ? false : options.badRejection;

HIGH shady-links-exfil-services: src/telegram.js:151 semgrep

URL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/yagop/node-telegram-bot-api/blob/65ef0a2fcccf96e1823b76654ffc909347f5876b/src/telegram.js#L151 149 | * @param {Object} [options.request] Options which will be added for all requests to telegram api. 150 | * See https://github.com/request/request#requestoptions-callback for more information. > 151 | * @param {String} [options.baseApiUrl="https://api.telegram.org"] API Base URl; useful for proxying and testing 152 | * @param {Boolean} [options.filepath=true] Allow passing file-paths as arguments when sending files, 153 | * such as photos using `TelegramBot#sendPhoto()`. See [usage information][usage-sending-files-performance]

HIGH shady-links-exfil-services: src/telegram.js:167 semgrep

URL pointing to known exfiltration/tunneling service Source: https://github.com/yagop/node-telegram-bot-api/blob/65ef0a2fcccf96e1823b76654ffc909347f5876b/src/telegram.js#L167 165 | this.options.polling = (typeof options.polling === 'undefined') ? false : options.polling; 166 | this.options.webHook = (typeof options.webHook === 'undefined') ? false : options.webHook; > 167 | this.options.baseApiUrl = options.baseApiUrl || 'https://api.telegram.org'; 168 | this.options.filepath = (typeof options.filepath === 'undefined') ? true : options.filepath; 169 | this.options.badRejection = (typeof options.badRejection === 'undefined') ? false : options.badRejection;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.65.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.65.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.64.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.26.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.