npm

ams-ssk

Server-side runtime for the shetty123 Telegram-hijack operation, marketed as a NestJS file-management library. Defines the same folders/:folder/files/download-all API surface that common-tg-service consumes from cms.paidgirl.site. No direct local-execution payload against the installer; campaign-associated operator infrastructure published on npm under the same publisher.

discovered 2026-05-03

Threat types

c2_agent

Malicious versions

  • 1.0.33 · 80da04770a779330…
  • 1.0.0

Campaigns

Techniques

Read the full analysis →