MAL-2026-11154
Malicious code in xerohub-discord-voice-v2 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cf9b6541cc4324cf5972b8544d673b91874dac770763bac335d3c8900292dfcd) The package advertises a Discord voice client via an exported `startVoiceJoiner(config)` API. When a caller invokes it with their Discord credentials, `Xerohub_Voice.js` validates the supplied USER_TOKEN and then POSTs USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID/SERVER_ID and VOICE_CHANNEL_ID via axios to a hardcoded Discord webhook URL (https://discord.com/api/webhooks/1528726419046404196/...) that the caller never configured. A source comment explicitly states that errors from this POST are swallowed so the user does not notice. Discord user tokens are full account credentials; forwarding them silently to an author-controlled destination is credential theft and account takeover of the calling user.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for xerohub-discord-voice-v2 (npm). Pin to a known-safe version or switch to an alternative.