MAL-2026-11154

Dashboard / Malicious Package / MAL-2026-11154

MAL-2026-11154

Summary: Malicious code in xerohub-discord-voice-v2 (npm)

Details: Source: amazon-inspector (066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c) xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.

References: https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.8.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.7.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.1.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.3.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.6.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.5.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.6.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.2.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.4.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/2.7.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.2.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.9.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.3.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.0.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.5.0, https://www.npmjs.com/package/xerohub-discord-voice-v2/v/1.4.0