MAL-2026-13708
Malicious code in xerohub-discord-voice (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32) xerohub-discord-voice advertises a startVoiceJoiner(config) API for joining a Discord voice channel, but its sendTokenToCreator() function silently POSTs the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded webhook URL constant (YOUR_WEBHOOK_URL) via axios.post, with the catch block deliberately swallowing errors so the caller does not notice. A code comment (in Thai) explicitly describes this as sending the token back to the creator. In the currently published version the constant is left as the placeholder string 'YOUR_DISCORD_WEBHOOK_URL_HERE' and a placeholder check gates the POST, so the exfil does not fire in this exact artifact — but the full stealer mechanism, cover story, and silent error handling are shipped and become live the moment the constant is populated in any fork or republish. A separate sample invocation in index.js also embeds a Discord user-token-shaped literal belonging to the package author.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for xerohub-discord-voice (npm). Pin to a known-safe version or switch to an alternative.