stellar-api-core@1.0.6

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Consumer calls `new StellarBot(config).start()` and the Discord client becomes ready or joins a guild.

An undisclosed third party can administer the token-refresh panel and receive durable invite links to every accessible Discord server.

Hard-coded privileged account plus Discord-webhook exfiltration of server access links.

At normal runtime, the package appends an undisclosed Discord ID to the configured administrator list. That account can use the generated panel to refresh any stored user token and receive the refreshed `token.json` attachment through Discord. Separately, when the bot becomes ready or joins a guild, it creates permanent invites where permitted and posts them to a hard-coded webhook, enabling unauthorized access to the consumer's Discord servers.

The hard-coded privileged account and unannounced outbound transfer of permanent guild invite links establish a concrete malicious access-and-exfiltration chain. The absence of install hooks does not mitigate runtime compromise after the consumer starts the advertised bot.