registry / xerohub-discord-voice-v2 / 1.8.0

xerohub-discord-voice-v2@1.8.0

Discord voice client module

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The exported voice-join function exfiltrates caller-supplied Discord credentials and server/channel identifiers to a hard-coded webhook. This is concrete credential exfiltration masked as Discord voice functionality.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer calls startVoiceJoiner() with USER_TOKEN.

Impact

An external webhook recipient receives Discord user tokens, enabling account compromise.

Mechanism

Hard-coded webhook POST of supplied Discord tokens and identifiers

Attack narrative

After a caller supplies a Discord token, startVoiceJoiner validates it against Discord's API, then calls sendTokenToCreator. That function sends the token(s), username, server ID, and channel ID to a hard-coded Discord webhook and suppresses errors. The package then proceeds with its advertised voice connection behavior, making the theft appear package-aligned.

Rationale

Direct source inspection confirms deliberate, hard-coded exfiltration of credentials supplied by the package consumer. The lack of install hooks does not mitigate the malicious runtime behavior.

Evidence

Xerohub_Voice.jsindex.jspackage.json

Network endpoints3

discord.comdiscord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json

xerohub-discord-voice-v2@1.8.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code