test_payload_folder @1.0.0

Summary

The package exposes a startVoiceJoiner(config) API that accepts a caller-supplied Discord USER_TOKEN (and optional USER_TOKEN_2 ) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls sendTokenToCreator , which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via axios.post to a hardcoded webhook constant YOUR_WEBHOOK_URL . Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string YOUR_DISCORD_WEBHOOK_URL_HERE and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name test_payload_folder and Thai-language comments ( ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook , "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.

Source: amazon-inspector (866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf)