xerohub-discord-voice

{"modified":"2026-08-10T12:53:43Z","published":"2026-08-10T12:34:05Z","schema_version":"1.7.4","id":"MAL-2026-13708","summary":"Malicious code in xerohub-discord-voice (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32)\nxerohub-discord-voice advertises a startVoiceJoiner(config) API for joining a Discord voice channel, but its sendTokenToCreator() function silently POSTs the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded webhook URL constant (YOUR_WEBHOOK_URL) via axios.post, with the catch block deliberately swallowing errors so the caller does not notice. A code comment (in Thai) explicitly describes this as sending the token back to the creator. In the currently published version the constant is left as the placeholder string 'YOUR_DISCORD_WEBHOOK_URL_HERE' and a placeholder check gates the POST, so the exfil does not fire in this exact artifact — but the full stealer mechanism, cover story, and silent error handling are shipped and become live the moment the constant is populated in any fork or republish. A separate sample invocation in index.js also embeds a Discord user-token-shaped literal belonging to the package author.\n","affected":[{"package":{"ecosystem":"npm","name":"xerohub-discord-voice"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"Xerohub_Voice.js","sha256":"89ffe211ad39ecb1d297684c884918036c430a64a00f845d30e5dc43e328fdf9","tlsh":"e932625b4d4214014e32a7648a13b017efaa6223261242d87bbcd3925ff5b1495bbfff"},{"path":"index.js","sha256":"6544bcb34444036db45dc889402e1274bff4068336324607146733e28a9d53ba","tlsh":"d511417e89612438597331e01b1e70c1fe627223531493077a7fd21a6f34a468632efe"}],"package_integrity":[{"filename":"xerohub-discord-voice-1.0.1.tgz","hashes":{"sha1":"92d9478718759e9f22ccef2fc1519fec6705c84a","sha512_sri":"sha512-tV9g4uu9okWDL+R3jHkQFdf8IyBW04CV3SyIsEdxMzjr4/TADBgLm7Yjbn1zZbaVmMGInruIDWSsZhOYuLx0sA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/xerohub-discord-voice/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017280","import_time":"2026-08-10T12:51:45.944942812Z","modified_time":"2026-08-10T12:34:17Z","sha256":"c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017279","import_time":"2026-08-10T12:51:45.856707555Z","modified_time":"2026-08-10T12:34:05Z","sha256":"d489def3fe801a7cdbd47e73ace258d61f4e448714438fda5fd3f93edf50b1f5","source":"amazon-inspector","versions":["1.0.0"]}]}}