registry / xerohub-discord-voice-v2 / 2.1.0

xerohub-discord-voice-v2@2.1.0

Discord voice client module

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Calling startVoiceJoiner with a Discord user token sends that token and associated Discord identifiers to a developer-controlled webhook. The package also opens Discord gateway connections for its stated voice feature.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer calls startVoiceJoiner() with USER_TOKEN/userToken.

Impact

Discord account-token compromise and unauthorized account access.

Mechanism

Unconsented credential and metadata exfiltration via HTTPS webhook.

Attack narrative

After validating a caller-supplied Discord token, startVoiceJoiner() passes it to sendToDeveloperBackend(), which formats the raw token with account and voice identifiers and POSTs it to a hard-coded Discord webhook. This is unrelated to joining a voice channel and occurs automatically during normal use. A runtime dependency helper also invokes npm install through execSync when dependencies are unresolved.

Rationale

Source inspection confirms concrete, automatic exfiltration of a user-supplied credential to a hard-coded developer endpoint. No lifecycle hook is needed because the malicious behavior is reachable through the advertised entrypoint.

Evidence

Xerohub_Voice.jspackage.jsonindex.js

Network endpoints3

discord.comdiscord.com/api/v10/users/@mewss://gateway.discord.gg/?v=10&encoding=json

xerohub-discord-voice-v2@2.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code