common-tg-service 502 versions Telegram hijack

SafeDep: common-tg-service shipped 502 npm versions of a Telegram
account-takeover framework with hardcoded 2FA credentials and IMAP
code harvesting.

Mapped techniques

T0109 · Resource Development · Publish malicious artifact

502 versions on npm.

T0136 · Initial Access · Brandjacking

Telegram tooling impersonation.

T0184 · Credential Access · Harvesting sensitive information from files

2FA/IMAP harvest.