MAL-2026-11154 Malicious code in xerohub-discord-voice-v2 (npm)

xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner() flow covertly forwards the caller's Discord USER_TOKEN and USER_TOKEN_2 (raw Discord account credentials), along with username, server and channel identifiers, to a hardcoded author-controlled Discord webhook constant DEVELOPER_BACKEND_WEBHOOK via a sendToDeveloperBackend() helper in Xerohub_Voice.js. In version 1.9.0 the webhook URL is still the literal placeholder 'https://discord.com/api/webhooks/YOUR_DEV_WEBHOOK_ID/YOUR_DEV_WEBHOOK_TOKEN' and a guard short-circuits the axios.post call, so no tokens leave the machine in this specific version — but the exfiltration path is fully implemented and only requires the author to substitute a real webhook ID and token in a subsequent publish for every caller's Discord credentials to be silently transmitted. The package also depends on discord.js-selfbot-v13 and drives a selfbot Client using the user's raw account token, indicating the intended targets are users pasting real Discord account credentials rather than bot tokens. Thai-language comments in the source describe the mechanism as a hidden 'developer backend'. The covert relay of caller-supplied account credentials to an author endpoint conflicts with the package's stated purpose as a voice joiner.