github TypeScript re-analysis due

dsnbyte/telesend

Send Telegram messages from your CLI, AI assistants (MCP), or REST API.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 11 tools

transport stdio counts 11 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 437caf6 · analyzer v33 · 4h ago

suspicious endpoint api.telegram.org dsnbyte-telesend-437caf6/src/telegram/client.ts :25 private readonly baseUrl = "https://api.telegram.org",
suspicious endpoint api.telegram.org dsnbyte-telesend-437caf6/tests/errors.test.ts :10 const output = redactSecrets(`failed ${token} https://api.telegram.org/bot${token}/sendMessage`);

code evidence vv0.1.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 44

fs dsnbyte-telesend-437caf6/src/core/paths.ts :1 import { chmod, mkdir } from "node:fs/promises";
fs dsnbyte-telesend-437caf6/src/db/database.ts :2 import { chmodSync, existsSync } from "node:fs";
fs dsnbyte-telesend-437caf6/src/mcp/config.ts :1 import { existsSync } from "node:fs";
fs dsnbyte-telesend-437caf6/src/mcp/file-policy.ts :1 import { constants } from "node:fs";
fs (weak) dsnbyte-telesend-437caf6/tests/cli.test.ts :3 import { mkdtemp } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/database.test.ts :3 import { chmod, mkdtemp, stat } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/e2e.test.ts :2 import { mkdtemp } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/mcp-policy.test.ts :2 import { mkdir, mkdtemp, symlink } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/mcp.test.ts :2 import { mkdtemp } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/paths.test.ts :2 import { mkdir, mkdtemp, stat } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/remote-mcp.test.ts :4 import { mkdtemp } from "node:fs/promises";
fs (weak) dsnbyte-telesend-437caf6/tests/telegram.test.ts :3 import { mkdtemp } from "node:fs/promises";

net dsnbyte-telesend-437caf6/src/mcp/remote-server.ts :33 fetch(request: Request): Response | Promise<Response>;
net dsnbyte-telesend-437caf6/src/rest/server.ts :22 fetch(request: Request): Response | Promise<Response>;
net (weak) dsnbyte-telesend-437caf6/tests/remote-mcp.test.ts :81 const unauthorized = await handler.fetch(new Request("https://local/mcp", { method: "POST" }));