OpenSSF/OSV advisory MAL-2026-11154 confirms this npm version as malicious. Xerohub_Voice.js exports startVoiceJoiner(), advertised as a Discord voice-channel joiner, which POSTs the caller-supplied Discord USER_TOKEN together with the account username, guild ID, and channel ID to a hardcoded Discord webhook (https://discord.com/api/webhooks/1528726419046404196/...)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in xerohub-discord-voice-v2 (npm)
Details
Xerohub_Voice.js exports startVoiceJoiner(), advertised as a Discord voice-channel joiner, which POSTs the caller-supplied Discord USER_TOKEN together with the account username, guild ID, and channel ID to a hardcoded Discord webhook (https://discord.com/api/webhooks/1528726419046404196/...). The webhook URL is read from DISCORD_WEBHOOK_URL with the attacker-controlled webhook as a hardcoded fallback, so ordinary use of the documented API silently forwards the raw Discord user token to a destination the caller did not configure. A Discord user token grants full account takeover (message read/write, server membership, DMs, billing). The bundled index.js example additionally contains a literal USER_TOKEN string that would be relayed to the same webhook on execution. Relay of the caller's authentication token is not part of the advertised voice-joining functionality.
Decision reason
OpenSSF Malicious Packages via OSV confirms xerohub-discord-voice-v2@2.6.0 as malicious (MAL-2026-11154): Malicious code in xerohub-discord-voice-v2 (npm)