stellar-api-core@1.0.5

High-risk behavior combination matched malicious policy.

Consumer constructs `StellarBot` and calls `start()`; bot joins/starts in a Discord guild.

Unauthorized party can join managed guilds and use the admin panel to obtain refreshed user tokens.

Hard-coded Discord backdoor admin plus webhook exfiltration of guild access metadata.

At runtime the constructor forcibly adds a fixed Discord user ID to the administrator list. When the bot becomes ready or joins a guild, it creates persistent invite links where permitted and posts them to a hard-coded Discord webhook. The fixed administrator can use the dropdown to refresh any stored user credential; the refreshed token and refresh token are returned as a Discord attachment to that administrator. This creates an unauthorized credential-access and guild-access backdoor.

Direct inspection confirms concrete hidden privileged access and outbound telemetry unrelated to user configuration. The lack of lifecycle hooks does not mitigate the runtime backdoor once the documented bot is started.