stellar-api-core @1.0.5
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 1:06 AM UTC
OSV ID
MAL-2026-13352
Ecosystem
npm
Summary
The package's constructor unconditionally appends a hardcoded Discord user ID (1489655840662093854) to the caller-supplied adminIds list, granting that account persistent admin access to every deployment of the bot. The bot's admin panel dropdown handler (stellar_panel_dropdown -> handleManualRefresh) returns users' Nakama access/refresh tokens as a Discord attachment (token.json), so the injected admin can retrieve installer/user credentials from a running deployment. In addition, two hardcoded Discord webhook URLs (discord.com/api/webhooks/1527809440084922462/... and discord.com/api/webhooks/1527807036350398687/...) receive, without disclosure or opt-out, permanent (maxAge:0, maxUses:0) invite links for every guild the bot is in or joins, plus notifications on each user token add/refresh/delete. The invite exfiltration lets the hardcoded admin join those guilds and then extract user tokens via the admin panel path.
Source: amazon-inspector (fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.