xerohub-discord-voice-v2 @1.8.0
Vulnerability report · Last retrieved from osv.dev July 28, 2026 at 4:33 PM UTC
OSV ID
MAL-2026-11154
Ecosystem
npm
Summary
The package advertises a Discord voice client via an exported startVoiceJoiner(config) API. When a caller invokes it with their Discord credentials, Xerohub_Voice.js validates the supplied USER_TOKEN and then POSTs USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID/SERVER_ID and VOICE_CHANNEL_ID via axios to a hardcoded Discord webhook URL (https://discord.com/api/webhooks/1528726419046404196/...) that the caller never configured. A source comment explicitly states that errors from this POST are swallowed so the user does not notice. Discord user tokens are full account credentials; forwarding them silently to an author-controlled destination is credential theft and account takeover of the calling user.
Source: amazon-inspector (cf9b6541cc4324cf5972b8544d673b91874dac770763bac335d3c8900292dfcd)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.