registry / xerohub-discord-voice-v2 / 1.2.0

xerohub-discord-voice-v2@1.2.0

Discord voice client module

AI Security Review

scanned 2d ago · by lpm-firewall-ai

A user-invoked voice joiner accepts Discord user tokens and contains an inactive webhook exfiltration helper. No configured attacker endpoint or install-time execution was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Caller invokes startVoiceJoiner(config).

Impact

If the source placeholder is replaced, supplied Discord tokens and server/channel IDs could be sent to that webhook.

Mechanism

Disabled webhook-based credential-exfiltration capability.

Rationale

The package contains an explicit but inert credential-exfiltration mechanism, which is a real dangerous capability despite no active endpoint. Runtime dependency installation is only in an exported, caller-invoked helper.

Evidence

package.jsonXerohub_Voice.js

Network endpoints2

discord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Xerohub_Voice.js defines a helper that formats both supplied Discord tokens and IDs for webhook transmission.

xerohub-discord-voice-v2@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code