Malicious code in xerohub-discord-voice (npm)

Source: amazon-inspector c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32 xerohub-discord-voice advertises a startVoiceJoinerconfig API for joining a Discord voice channel, but its sendTokenToCreator function silently POSTs the caller-supplied USERTOKEN, USERTOKEN2, VOICESERVERID,...