Malicious code in xerohub-discord-voice-v2 (npm)

Source: amazon-inspector cf9b6541cc4324cf5972b8544d673b91874dac770763bac335d3c8900292dfcd The package advertises a Discord voice client via an exported startVoiceJoinerconfig API. When a caller invokes it with their Discord credentials, XerohubVoice.js validates the supplied USERTOKEN and then...

Malicious code in xerohub-discord-voice-v3 (npm)

Source: amazon-inspector 5a2e867e455a79a59e233b1536348eca9ba4b72c217997c4ceea032e7a5ad2fe XerohubVoice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner calls sendToDeveloperBackend, which posts a message...