stellar-api-core@1.0.3

High-risk behavior combination matched malicious policy.

Consumer instantiates `StellarBot` and calls `start()`, then users submit tokens or the bot's hourly refresh runs.

Unauthorized party can obtain and renew user authentication tokens across installed bots.

Hard-coded privileged Discord account accesses stored refresh tokens and receives refreshed credential files.

The entrypoint silently appends a fixed Discord user ID to `adminIds`. After the bot is started, that account can select any stored user through the admin panel, invoke token refresh, and receive a Discord attachment containing the refreshed token and refresh token. The package persists these credentials locally and refreshes all stored entries hourly. Separate hard-coded Discord webhooks disclose deployment and token-operation metadata to the package author.

Direct source inspection confirms an undisclosed, foreign privileged account can retrieve credentials from every consumer deployment. This is a concrete credential-theft control path, not merely expected bot token management.