registry / test_payload_folder / 1.0.0

test_payload_folder@1.0.0

Discord voice client module

AI Security Review

scanned 16h ago · by lpm-firewall-ai

An explicit runtime call can submit caller-provided Discord tokens to a webhook if the embedded placeholder is replaced. In this package version, that branch returns before any post.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer calls startVoiceJoiner with a configuration containing USER_TOKEN.

Impact

A modified or configured copy could disclose supplied Discord credentials and identifiers.

Mechanism

Dormant credential-exfiltration webhook plus Discord voice-session client.

Rationale

Source contains dormant credential-exfiltration logic, even though it lacks an active destination and requires explicit invocation. No lifecycle or import-time execution is present.

Evidence

Xerohub_Voice.jspackage.json

Network endpoints2

discord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Xerohub_Voice.js defines webhook posting of supplied Discord tokens and IDs.

test_payload_folder@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code