stellar-api-core@1.0.4

High-risk behavior combination matched malicious policy.

A consumer instantiates `StellarBot`, calls `start()`, and the hard-coded Discord account uses the generated admin panel.

Unauthorized credential disclosure for every user whose token is stored by a deployed bot.

Hard-coded privileged Discord account retrieves other users' refreshed credentials.

The runtime constructor silently adds a fixed Discord user ID as an administrator. When that account accesses the panel, it can select any stored user; the refresh handler reads that user's refresh token, receives new token material from the configured backend, writes it locally, and attaches both new credentials to the acting admin's Discord response. This creates an undisclosed credential-access backdoor independent of the consumer-supplied admin list.

Direct source inspection confirms a concrete, runtime-reachable credential disclosure path through a hidden global administrator. The absence of lifecycle hooks does not mitigate the backdoor once the documented bot is started.