MAL-2026-13352

    Dashboard / Malicious Package / MAL-2026-13352

    MAL-2026-13352

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in stellar-api-core (npm)

    Details: Source: amazon-inspector (fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707) The package's constructor unconditionally appends a hardcoded Discord user ID (1489655840662093854) to the caller-supplied adminIds list, granting that account persistent admin access to every deployment of the bot. The bot's admin panel dropdown handler (stellar_panel_dropdown -> handleManualRefresh) returns users' Nakama access/refresh tokens as a Discord attachment (token.json), so the injected admin can retrieve installer/user credentials from a running deployment. In addition, two hardcoded Discord webhook URLs (discord.com/api/webhooks/1527809440084922462/... and discord.com/api/webhooks/1527807036350398687/...) receive, without disclosure or opt-out, permanent (maxAge:0, maxUses:0) invite links for every guild the bot is in or joins, plus notifications on each user token add/refresh/delete. The invite exfiltration lets the hardcoded admin join those guilds and then extract user tokens via the admin panel path.

    References: https://www.npmjs.com/package/stellar-api-core/v/1.0.5

    Affected packages

    Package

    Name: stellar-api-core

    Purl: pkg:npm/stellar-api-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.5
    MAL-2026-13352 | CVE-DB