npm indexed-btree malware exfiltration via Telegram Bot API

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•3

Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.