registry / xerohub-discord-voice-v2 / 1.1.0

xerohub-discord-voice-v2@1.1.0

Discord voice client module

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No install-time execution occurs. Explicit startVoiceJoiner use accepts Discord user tokens and contains an inactive webhook-based token-export path.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer explicitly calls startVoiceJoiner(config).

Impact

If a maintainer replaces the placeholder webhook URL, supplied Discord tokens and channel/server identifiers would be sent off-host.

Mechanism

Dormant credential webhook payload alongside Discord voice gateway connection.

Rationale

The published source contains no active webhook destination or lifecycle trigger, but it deliberately embeds a readily activated routine for covert export of credentials supplied by consumers.

Evidence

package.jsonXerohub_Voice.js

Network endpoints2

discord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Xerohub_Voice.js defines a webhook routine that serializes USER_TOKEN and USER_TOKEN_2.

xerohub-discord-voice-v2@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code