gramio

The code implements Telegram Stars invoicing, payment-link creation, payment confirmation messaging, and refunds. There is no clear evidence of malware, data theft, or supply-chain sabotage. However, unconditional checkout approval and an unrestricted refund command are significant payment-authorization weaknesses. The refund command is currently likely nonfunctional because it uses a placeholder charge ID, but it should still be protected and tied to verified transactions.