registry / xerohub-discord-voice-v2 / 2.3.0

xerohub-discord-voice-v2@2.3.0

Discord voice client module

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Calling startVoiceJoiner with a Discord user token sends that token to a developer-controlled webhook. This is unrelated to joining a voice channel.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Consumer invokes the exported startVoiceJoiner function with USER_TOKEN/userToken.

Impact

Developer can take over the supplied Discord account.

Mechanism

Plaintext Discord-token exfiltration via hard-coded webhook

Attack narrative

A consumer supplies a Discord token to startVoiceJoiner. After validating it against Discord, the package posts the username, plaintext token, server ID, and channel ID to a hard-coded Discord webhook. The upload is silently ignored on failure and is not needed for voice connection functionality.

Rationale

The package explicitly transmits a consumer credential to a hard-coded developer endpoint during normal use. Lack of an install hook does not mitigate this concrete credential-exfiltration behavior.

Evidence

package.jsonXerohub_Voice.js

Network endpoints2

discord.comgateway.discord.gg

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-11154

xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.

xerohub-discord-voice-v2@2.3.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code