stellar-api-safe@1.0.8

High-risk behavior combination matched malicious policy.

Consumer instantiates StellarBot and calls start(); Discord token commands or refresh events then occur.

Unconsented disclosure of Discord usernames, user IDs, and token-operation metadata to an external webhook.

hard-coded webhook telemetry of token-management activity

The exported bot must be explicitly started, then accepts user tokens and refresh tokens. Although refresh requests go to the consumer-configured backend, every add/delete/refresh/failure event is also posted to an embedded Discord webhook controlled outside the consumer's configuration. Those posts disclose user identifiers and token-management activity without a way for the consumer to select or disable the recipient.

Source inspection confirms a concrete, externally directed metadata-exfiltration channel rather than only scanner heuristics. It is runtime-gated but uses a hard-coded recipient unrelated to required bot configuration.