self-v8@8.7.9
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe exported check() function collects Discord tokens and caller configuration, then sends them to a fixed channel using a hard-coded Discord account. Although it is not invoked automatically on import, this is deliberate credential theft when the function is used.
Decision evidence
public snapshot- check() reads the caller’s main file and extracts its CONFIG block, including token values.
- The function validates extracted tokens, then prepares the CONFIG block and validation report for a hard-coded Discord channel.
- It logs in to Discord using a hard-coded sender token and sends the prepared data when check() is called.
- The manifest declares no install lifecycle scripts.
- The package entry point exports check() without calling it at import time.
Source & flagged code
3 flaggedcheck() reads the caller’s main file and extracts its CONFIG block, including token values.
index.jsView on unpkg · L10The function validates extracted tokens, then prepares the CONFIG block and validation report for a hard-coded Discord channel.
index.jsView on unpkg · L55It logs in to Discord using a hard-coded sender token and sends the prepared data when check() is called.
Findings
Affected versions and remediation
This report applies to self-v8@8.7.9.
See all versions of self-v8 for other recorded verdicts.
- Avoid installing self-v8@8.7.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.