xerohub-discord-voice-v2

{"schema_version":"1.7.4","id":"MAL-2026-11154","published":"2026-07-28T13:30:27Z","modified":"2026-08-10T12:53:43.768024698Z","summary":"Malicious code in xerohub-discord-voice-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c)\nxerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.\n","affected":[{"package":{"name":"xerohub-discord-voice-v2","ecosystem":"npm"},"versions":["1.8.0","1.7.0","2.1.0","2.3.0","1.6.0","2.5.0","2.6.0","2.2.0","2.4.0","2.7.0","1.2.0","1.9.0","1.3.0","1.0.0","1.5.0","1.4.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"Xerohub_Voice.js","sha256":"97cce60b5983134e9e561e2bcfc6281addc2ad351a8747ad032947540ceb0dd0","tlsh":"0632519b494214114e3327a58613b01aefaa6323261602d87fbdc3919ff5b1495b3ffe"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.8.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.7.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.5.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.6.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.7.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.9.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.5.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.4.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010876","import_time":"2026-07-28T14:19:57.043852283Z","modified_time":"2026-07-28T13:30:27Z","sha256":"cf9b6541cc4324cf5972b8544d673b91874dac770763bac335d3c8900292dfcd","source":"amazon-inspector","versions":["1.8.0"]},{"id":"IN-MAL-2026-014953","import_time":"2026-08-05T14:19:46.33494453Z","modified_time":"2026-08-05T13:16:31Z","sha256":"1d3b956e561364b5946652654802761572f9adec882e0310d31f26ac8e032310","source":"amazon-inspector","versions":["1.7.0"]},{"id":"IN-MAL-2026-014952","import_time":"2026-08-05T14:19:46.163928332Z","modified_time":"2026-08-05T13:16:23Z","sha256":"89472a6e52613058ddf64e3b4ae4228a04b8bfa7fa6a75bd70364c6387a8fc4e","source":"amazon-inspector","versions":["2.1.0"]},{"id":"IN-MAL-2026-014954","import_time":"2026-08-05T14:19:46.434662662Z","modified_time":"2026-08-05T13:16:41Z","sha256":"9a9c075d2e98d863ae20c31c114936fd16d6ff3abe0e52f78ef366eb165ce716","source":"amazon-inspector","versions":["2.3.0"]},{"id":"IN-MAL-2026-014951","import_time":"2026-08-05T14:19:46.069686301Z","modified_time":"2026-08-05T13:16:16Z","sha256":"c492698d0815abeaa486c8e61c5d4a29d56ffaf7f5d9fbaf465496b12a42bfaf","source":"amazon-inspector","versions":["1.6.0"]},{"id":"IN-MAL-2026-014958","import_time":"2026-08-05T14:19:46.804668702Z","modified_time":"2026-08-05T13:17:15Z","sha256":"082f90d492eb917644dd44d1ebc7befa5557488e188174ed04241b8163d547ac","source":"amazon-inspector","versions":["2.5.0"]},{"id":"IN-MAL-2026-014957","import_time":"2026-08-05T14:19:46.710445017Z","modified_time":"2026-08-05T13:17:06Z","sha256":"3837c62fcf0813092b1bf51eaf6f47ffd9477d8b4aa9c9e02a42de7ea466ba95","source":"amazon-inspector","versions":["2.6.0"]},{"id":"IN-MAL-2026-014955","import_time":"2026-08-05T14:19:46.530480046Z","modified_time":"2026-08-05T13:16:48Z","sha256":"86630f2d32ad3a1a8ae419e538be3c6b46ce5f64ea5e871e1ccdf34c402d0032","source":"amazon-inspector","versions":["2.2.0"]},{"id":"IN-MAL-2026-014956","import_time":"2026-08-05T14:19:46.632371733Z","modified_time":"2026-08-05T13:16:57Z","sha256":"ae2ea1c3851cbf6d3ffa6a3b698dad72436ba200f7a6dbf41c7477b2f0ef808a","source":"amazon-inspector","versions":["2.4.0"]},{"id":"IN-MAL-2026-014959","import_time":"2026-08-05T14:19:46.921525513Z","modified_time":"2026-08-05T13:17:25Z","sha256":"b59063377466896bea6fd9d2eef88fb4450917540c1e5214a6c25ce08de3974c","source":"amazon-inspector","versions":["2.7.0"]},{"id":"IN-MAL-2026-017277","import_time":"2026-08-10T12:51:45.698791671Z","modified_time":"2026-08-10T12:33:43Z","sha256":"c64830f9cd9a4d705686a5ee08a344e3fd146ab965053dda6e625542388ad487","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-017278","import_time":"2026-08-10T12:51:45.796495769Z","modified_time":"2026-08-10T12:33:55Z","sha256":"066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c","source":"amazon-inspector","versions":["1.9.0"]},{"id":"IN-MAL-2026-017274","import_time":"2026-08-10T12:51:45.499783498Z","modified_time":"2026-08-10T12:33:20Z","sha256":"17bcb0422625a11dccf623f7b4a05250edceb66a10ea72be5aa9262ca5c2ad05","source":"amazon-inspector","versions":["1.3.0"]},{"id":"IN-MAL-2026-017273","import_time":"2026-08-10T12:51:45.432339171Z","modified_time":"2026-08-10T12:33:12Z","sha256":"318f3b17f9ba6d30a0c0a84fcabb0b6bdb713b33b6edc77d61d3cc62c4c2da54","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017275","import_time":"2026-08-10T12:51:45.605703842Z","modified_time":"2026-08-10T12:33:28Z","sha256":"3995f5c811df7a41cb6945af1307b04bea934e81188c13705df67c697d4fcb96","source":"amazon-inspector","versions":["1.5.0"]},{"id":"IN-MAL-2026-017276","import_time":"2026-08-10T12:51:45.634880495Z","modified_time":"2026-08-10T12:33:35Z","sha256":"41890416e5f78be022ddc5de2d56a915bc75403e07878176a057cacc6fd410d1","source":"amazon-inspector","versions":["1.4.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}