registry / xerohub-discord-voice-v2 / 1.9.0

xerohub-discord-voice-v2@1.9.0

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The runtime module contains a dormant token-exfiltration path gated by an unconfigured webhook placeholder. No install-time execution or currently reachable third-party credential post exists in this release.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer explicitly calls startVoiceJoiner with a Discord user token.

Impact

If the placeholder were replaced, supplied Discord tokens and channel metadata would be sent to the webhook.

Mechanism

Dormant webhook credential-post capability

Rationale

The supplied source does not perform actual exfiltration because its only developer webhook is intentionally placeholder-gated. Its embedded credential-post design remains a concrete dormant dangerous capability, warranting a warning rather than a block.

Evidence

Xerohub_Voice.jsindex.jspackage.json

Network endpoints2

discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKENdiscord.com/api/v10/users/@me

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-11154

Source

OpenSSF Malicious Packages via OSV

xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.

xerohub-discord-voice-v2@1.9.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code