MAL-2026-14191
Malicious code in test_payload_folder (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf) The package exposes a `startVoiceJoiner(config)` API that accepts a caller-supplied Discord `USER_TOKEN` (and optional `USER_TOKEN_2`) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls `sendTokenToCreator`, which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via `axios.post` to a hardcoded webhook constant `YOUR_WEBHOOK_URL`. Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string `YOUR_DISCORD_WEBHOOK_URL_HERE` and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name `test_payload_folder` and Thai-language comments (`ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook`, "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for test_payload_folder (npm). Pin to a known-safe version or switch to an alternative.