MAL-2026-13352

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707) The package's constructor unconditionally appends a hardcoded Discord user ID (1489655840662093854) to the caller-supplied adminIds list, granting that account persistent admin access to every deployment of the bot. The bot's admin panel dropdown handler (stellar_panel_dropdown -> handleManualRefresh) returns users' Nakama access/refresh tokens as a Discord attachment (token.json), so the injected admin can retrieve installer/user credentials from a running deployment. In addition, two hardcoded Discord webhook URLs (discord.com/api/webhooks/1527809440084922462/... and discord.com/api/webhooks/1527807036350398687/...) receive, without disclosure or opt-out, permanent (maxAge:0, maxUses:0) invite links for every guild the bot is in or joins, plus notifications on each user token add/refresh/delete. The invite exfiltration lets the hardcoded admin join those guilds and then extract user tokens via the admin panel path.