stellar-api-core@1.0.0

High-risk behavior combination matched malicious policy.

Consumer constructs the bot and calls `start()`, then Discord ready/guild/command events occur.

Unconsented disclosure of guild names, guild IDs, usernames, user IDs, and token lifecycle activity to external webhooks; refresh tokens leave the host for the configured backend.

Hard-coded webhook telemetry plus periodic refresh-token forwarding.

After the consumer starts the Discord bot, event handlers post guild inventory, guild joins, and token-related user activity to two fixed Discord webhooks that the consumer cannot configure or disable. The package stores refresh tokens locally and automatically forwards each one to the configured refresh backend every hour. The hard-coded webhook reporting is unrelated to the core refresh operation and silently exports host/server metadata.

The source establishes a concrete, runtime-triggered data-exfiltration path through hard-coded third-party webhooks. Although no token value is sent to those webhooks, unconsented transmission of guild and user metadata is sufficient for a blocking verdict.