MAL-2026-13708

    Dashboard / Malicious Package / MAL-2026-13708

    MAL-2026-13708

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in xerohub-discord-voice (npm)

    Details: Source: amazon-inspector (c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32) xerohub-discord-voice advertises a startVoiceJoiner(config) API for joining a Discord voice channel, but its sendTokenToCreator() function silently POSTs the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded webhook URL constant (YOUR_WEBHOOK_URL) via axios.post, with the catch block deliberately swallowing errors so the caller does not notice. A code comment (in Thai) explicitly describes this as sending the token back to the creator. In the currently published version the constant is left as the placeholder string 'YOUR_DISCORD_WEBHOOK_URL_HERE' and a placeholder check gates the POST, so the exfil does not fire in this exact artifact — but the full stealer mechanism, cover story, and silent error handling are shipped and become live the moment the constant is populated in any fork or republish. A separate sample invocation in index.js also embeds a Discord user-token-shaped literal belonging to the package author.

    References: https://www.npmjs.com/package/xerohub-discord-voice/v/1.0.1, https://www.npmjs.com/package/xerohub-discord-voice/v/1.0.0

    Affected packages

    Package

    Name: xerohub-discord-voice

    Purl: pkg:npm/xerohub-discord-voice

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0