xerohub-discord-voice-v3

{"schema_version":"1.7.4","id":"MAL-2026-11155","published":"2026-07-28T13:30:35Z","modified":"2026-08-05T14:22:16.666279525Z","summary":"Malicious code in xerohub-discord-voice-v3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5a2e867e455a79a59e233b1536348eca9ba4b72c217997c4ceea032e7a5ad2fe)\nXerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner() calls sendToDeveloperBackend, which posts a message containing the raw token, the Discord username, the target guild ID, and the target voice channel ID via axios.post to a fixed discord.com/api/webhooks/1528726419046404196/... URL used as a fallback whenever DISCORD_WEBHOOK_URL is unset. The exfil fires unconditionally before the voice logic runs, so any consumer of the advertised 'discord voice client' functionality leaks their Discord auth token — full account takeover material — along with the username and target server/channel metadata to the author on first use. Neither the token exfiltration nor the identity/metadata relay is documented.\n","affected":[{"package":{"name":"xerohub-discord-voice-v3","ecosystem":"npm"},"versions":["3.0.2","3.0.0","3.0.3","3.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"Xerohub_Voice.js","sha256":"3724e0d3fb89335fde1c2d3659f0da3333fdb8a2eef5e1fa28e1eb9a93de9ede","tlsh":"de32975f59e350124763209581dbf01123b56203190aeed07bbe83a1eff9968b4f3be6"}],"package_integrity":[{"filename":"xerohub-discord-voice-v3-3.0.2.tgz","hashes":{"sha1":"6a81c7072882481d16b043958ebb0ab32733a4bb","sha512_sri":"sha512-945KbxoJMwbJBdSdBiBNIZLEQ4Im1uOjjhZ+pGsJZCyAme6hkuW54Kaiq2QcU3e0hFc41PKAZ97j6Q3yzoTl6w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v3/v/3.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v3/v/3.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v3/v/3.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice-v3/v/3.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010881","import_time":"2026-07-28T14:19:57.255424039Z","modified_time":"2026-07-28T13:31:09Z","sha256":"5a2e867e455a79a59e233b1536348eca9ba4b72c217997c4ceea032e7a5ad2fe","source":"amazon-inspector","versions":["3.0.2"]},{"id":"IN-MAL-2026-010883","import_time":"2026-07-28T14:19:57.346453395Z","modified_time":"2026-07-28T13:31:23Z","sha256":"9377ba8131678848902de789d072550b3b92b8c8e823dec9f6a563ddf0942873","source":"amazon-inspector","versions":["3.0.0"]},{"id":"IN-MAL-2026-010877","import_time":"2026-07-28T14:19:57.077761245Z","modified_time":"2026-07-28T13:30:35Z","sha256":"93f425bbeac489a5cfddb532929e0f5f7dfd6a8315ff10afbc6c3751bf2e9d37","source":"amazon-inspector","versions":["3.0.3"]},{"id":"IN-MAL-2026-014948","import_time":"2026-08-05T14:19:45.765584214Z","modified_time":"2026-08-05T13:15:48Z","sha256":"c36914a36e960d58a04f30ea083535253930ac309f36acde9ae6c30cd3d48399","source":"amazon-inspector","versions":["3.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}