registry / Malware / @velliajs/discord

@velliajs/discord

Discord Bot Libray By Valera

This report shows the evidence for @velliajs/discord@1.0.7. 5 of 5 known versions are blocked or flagged. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14051 confirms this npm version as malicious.

Advisory

MAL-2026-14051

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @velliajs/discord (npm)

Details

The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js.git`, README instructs `import... from '@verylinh/discord'`) but ships two installer-relevant hostile mechanisms. First, `package.json` declares a runtime dependency `sysframe` resolved from `git+https://ghp_...@github.com/navaLinh/node-ai.git` — an unpinned (no commit SHA or tag), private, author-controlled GitHub repository, using an embedded live GitHub Personal Access Token. Every `npm install` uses the shipped token to fetch the current HEAD of that private repo into the installer's `node_modules`; the author can rewrite HEAD at any time to deliver arbitrary code, including lifecycle scripts, that will execute on subsequent installs. Second, `Client.login()` invokes an undocumented `_verifyAuthorization` routine that fetches an allow-list JSON from `api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json` under a hardcoded PAT and refuses to start the installer's Discord bot unless the bot's username appears in the author-controlled allow-list — a hidden remote gate/kill-switch over the installer's runtime that is not disclosed in the README. Two live GitHub PATs are hardcoded in the shipped package (one in the git dependency URL, one as the default `ghToken` in `_validateAuthOptions`). The package name and metadata impersonate discord.js.

References

OpenSSF/OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

Direct inspection confirms exposed embedded credentials and remote access-control behavior, but not payload execution, harvesting, or unconsented install-time mutation. The scanner's claimed remote decode-and-execute chain is not present in the inspected source.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Install dependency; or construct Client with a non-null second argument and call login.

Impact

Supply-chain credential exposure and externally controlled denial of Discord client login.

Mechanism

Embedded credentials and remote authorization allowlist

AI rationale

Evidence

package.jsonsrc/client/Client.jssrc/sharding/Shard.jssrc/sharding/ShardingManager.jssrc/sharding/ShardClientUtil.jssrc/index.jssrc/client/BaseClient.jssrc/util/Util.js

Network endpoints3

github.com/navaLinh/node-ai.gitdiscord.com/api/v10/users/@me/repos/Vellia-Elyvia/mydb/contents/db.json

Independent scan evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for AI warning decision

package.json embeds a GitHub PAT in a git dependency URL.
src/client/Client.js embeds a second GitHub PAT and queries a private GitHub JSON allowlist.
Client authorization is triggered by a non-null second constructor argument before login.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No source path decodes or executes remotely fetched content.
Shard eval and child-process use are explicit sharding APIs invoked by caller methods.
No credential/file harvesting or third-party exfiltration was found.

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 314 file(s), 551 KB of source, external domains: api.github.com, discord.com, media.discordapp.net

Source & flagged code

8 flagged

package.jsonView file

62patternName = github_pat severity = critical line = 62 matchedText = "sysfram...it",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

package.jsonView on unpkg · L62

62patternName = github_pat severity = critical line = 62 matchedText = "sysfram...it",

Critical

Secret Pattern

GitHub personal access token in package.json

package.jsonView on unpkg · L62

src/sharding/ShardingManager.jsView file

111L112: async spawn({ amount = this.totalShards, delay = 5500, timeout = 30_000 } = {}) { L113:

High

Child Process

Package source references child process execution.

src/sharding/ShardingManager.jsView on unpkg · L111

src/sharding/Shard.jsView file

209L210: eval(script, context) { L211:

High

Eval

Package source references dynamic code evaluation.

src/sharding/Shard.jsView on unpkg · L209

src/client/Client.jsView file

3const process = require('node:process'); L4: const axios = require('axios'); L5: const { Collection } = require('@discordjs/collection'); L6: const { makeURLSearchParams } = require('@discordjs/rest'); L7: const { OAuth2Scopes, Routes } = require('discord-api-types/v10'); ... L38: L39: const data = require('node:worker_threads').workerData ?? process.env; L40: const defaults = Options.createDefault(); ... L43: if ('SHARDS' in data) { L44: this.options.shards = JSON.parse(data.SHARDS); L45: } ... L155: async fetchInvite(invite, options) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

src/client/Client.jsView on unpkg · L3

•Trigger-reachable chain: manifest.main -> src/index.js -> src/client/Client.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/client/Client.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @velliajs/discord@1.0.4 matchedIdentity = npm:QHZlbGxpYWpzL2Rpc2NvcmQ:1.0.4 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Source & flagged code

8 flagged · loading source

package.jsonView file

62patternName = github_pat severity = critical line = 62 matchedText = "sysfram...it",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

package.jsonView on unpkg · L62

62patternName = github_pat severity = critical line = 62 matchedText = "sysfram...it",

Critical

Secret Pattern

GitHub personal access token in package.json

package.jsonView on unpkg · L62

src/sharding/ShardingManager.jsView file

111L112: async spawn({ amount = this.totalShards, delay = 5500, timeout = 30_000 } = {}) { L113:

High

Child Process

Package source references child process execution.

src/sharding/ShardingManager.jsView on unpkg · L111

Findings

6 Critical2 High4 Medium4 Low

CriticalCritical Secretpackage.json

CriticalRemote Asset Decode Executesrc/client/Client.js

CriticalTrigger Reachable Dangerous Capabilitysrc/client/Client.js

CriticalPrevious Version Dangerous Deltasrc/client/Client.js

CriticalSecret Patternpackage.json

CriticalSecret Patternsrc/client/Client.js

HighChild Processsrc/sharding/ShardingManager.js

HighEvalsrc/sharding/Shard.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @velliajs/discord@1.0.7.

The versions list below shows the verdict for each recorded version.

Avoid installing @velliajs/discord@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-14 23:00:05.826Z (UTC).

Source advisory published: 2026-08-14 22:28:38.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

1.0.7latestshownMaliciousMalwareBlockPublishedAug 1, 2026, 10:07 PM 1.0.6MaliciousMalwareBlockPublishedAug 1, 2026, 8:57 PM 1.0.5MaliciousMalwareBlockPublishedAug 1, 2026, 2:58 PM 1.0.4MaliciousMalwareBlockPublishedAug 1, 2026, 12:11 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code