MAL-2026-11154

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xerohub-discord-voice-v2/MAL-2026-11154.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11154

Published

2026-07-28T13:30:27Z

Modified

2026-08-10T13:05:02Z

Summary

Malicious code in xerohub-discord-voice-v2 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c)

xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010876",
            "import_time": "2026-07-28T14:19:57.043852283Z",
            "modified_time": "2026-07-28T13:30:27Z",
            "sha256": "cf9b6541cc4324cf5972b8544d673b91874dac770763bac335d3c8900292dfcd",
            "source": "amazon-inspector",
            "versions": [
                "1.8.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014953",
            "import_time": "2026-08-05T14:19:46.33494453Z",
            "modified_time": "2026-08-05T13:16:31Z",
            "sha256": "1d3b956e561364b5946652654802761572f9adec882e0310d31f26ac8e032310",
            "source": "amazon-inspector",
            "versions": [
                "1.7.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014952",
            "import_time": "2026-08-05T14:19:46.163928332Z",
            "modified_time": "2026-08-05T13:16:23Z",
            "sha256": "89472a6e52613058ddf64e3b4ae4228a04b8bfa7fa6a75bd70364c6387a8fc4e",
            "source": "amazon-inspector",
            "versions": [
                "2.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014954",
            "import_time": "2026-08-05T14:19:46.434662662Z",
            "modified_time": "2026-08-05T13:16:41Z",
            "sha256": "9a9c075d2e98d863ae20c31c114936fd16d6ff3abe0e52f78ef366eb165ce716",
            "source": "amazon-inspector",
            "versions": [
                "2.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014951",
            "import_time": "2026-08-05T14:19:46.069686301Z",
            "modified_time": "2026-08-05T13:16:16Z",
            "sha256": "c492698d0815abeaa486c8e61c5d4a29d56ffaf7f5d9fbaf465496b12a42bfaf",
            "source": "amazon-inspector",
            "versions": [
                "1.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014958",
            "import_time": "2026-08-05T14:19:46.804668702Z",
            "modified_time": "2026-08-05T13:17:15Z",
            "sha256": "082f90d492eb917644dd44d1ebc7befa5557488e188174ed04241b8163d547ac",
            "source": "amazon-inspector",
            "versions": [
                "2.5.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014957",
            "import_time": "2026-08-05T14:19:46.710445017Z",
            "modified_time": "2026-08-05T13:17:06Z",
            "sha256": "3837c62fcf0813092b1bf51eaf6f47ffd9477d8b4aa9c9e02a42de7ea466ba95",
            "source": "amazon-inspector",
            "versions": [
                "2.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014955",
            "import_time": "2026-08-05T14:19:46.530480046Z",
            "modified_time": "2026-08-05T13:16:48Z",
            "sha256": "86630f2d32ad3a1a8ae419e538be3c6b46ce5f64ea5e871e1ccdf34c402d0032",
            "source": "amazon-inspector",
            "versions": [
                "2.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014956",
            "import_time": "2026-08-05T14:19:46.632371733Z",
            "modified_time": "2026-08-05T13:16:57Z",
            "sha256": "ae2ea1c3851cbf6d3ffa6a3b698dad72436ba200f7a6dbf41c7477b2f0ef808a",
            "source": "amazon-inspector",
            "versions": [
                "2.4.0"
            ]
        },
        {
            "id": "IN-MAL-2026-014959",
            "import_time": "2026-08-05T14:19:46.921525513Z",
            "modified_time": "2026-08-05T13:17:25Z",
            "sha256": "b59063377466896bea6fd9d2eef88fb4450917540c1e5214a6c25ce08de3974c",
            "source": "amazon-inspector",
            "versions": [
                "2.7.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017277",
            "import_time": "2026-08-10T12:51:45.698791671Z",
            "modified_time": "2026-08-10T12:33:43Z",
            "sha256": "c64830f9cd9a4d705686a5ee08a344e3fd146ab965053dda6e625542388ad487",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017278",
            "import_time": "2026-08-10T12:51:45.796495769Z",
            "modified_time": "2026-08-10T12:33:55Z",
            "sha256": "066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c",
            "source": "amazon-inspector",
            "versions": [
                "1.9.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017274",
            "import_time": "2026-08-10T12:51:45.499783498Z",
            "modified_time": "2026-08-10T12:33:20Z",
            "sha256": "17bcb0422625a11dccf623f7b4a05250edceb66a10ea72be5aa9262ca5c2ad05",
            "source": "amazon-inspector",
            "versions": [
                "1.3.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017273",
            "import_time": "2026-08-10T12:51:45.432339171Z",
            "modified_time": "2026-08-10T12:33:12Z",
            "sha256": "318f3b17f9ba6d30a0c0a84fcabb0b6bdb713b33b6edc77d61d3cc62c4c2da54",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017275",
            "import_time": "2026-08-10T12:51:45.605703842Z",
            "modified_time": "2026-08-10T12:33:28Z",
            "sha256": "3995f5c811df7a41cb6945af1307b04bea934e81188c13705df67c697d4fcb96",
            "source": "amazon-inspector",
            "versions": [
                "1.5.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017276",
            "import_time": "2026-08-10T12:51:45.634880495Z",
            "modified_time": "2026-08-10T12:33:35Z",
            "sha256": "41890416e5f78be022ddc5de2d56a915bc75403e07878176a057cacc6fd410d1",
            "source": "amazon-inspector",
            "versions": [
                "1.4.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / xerohub-discord-voice-v2

Package

Name: xerohub-discord-voice-v2; View open source insights on deps.dev
Purl: pkg:npm/xerohub-discord-voice-v2

Affected ranges

Affected versions

1.*

1.0.0

1.2.0

1.3.0

1.4.0

1.5.0

1.6.0

1.7.0

1.8.0

1.9.0

2.*

2.1.0

2.2.0

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "Xerohub_Voice.js",
            "sha256": "97cce60b5983134e9e561e2bcfc6281addc2ad351a8747ad032947540ceb0dd0",
            "tlsh": "0632519b494214114e3327a58613b01aefaa6323261602d87fbdc3919ff5b1495b3ffe"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xerohub-discord-voice-v2/MAL-2026-11154.json"