MAL-2026-11155 Malicious code in xerohub-discord-voice-v3 (npm)
Malicious package
Published
MAL-2026-11155 is a malicious package: xerohub-discord-voice-v3 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11155/ (Markdown: https://insights.sbomify.com/MAL-2026-11155/index.md)
- Package
- xerohub-discord-voice-v3
- Registry
- npm
What is MAL-2026-11155?
MAL-2026-11155 is a malicious package in xerohub-discord-voice-v3, published on 28 Jul 2026.
Official description
Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner() calls sendToDeveloperBackend, which posts a message containing the raw token, the Discord username, the target guild ID, and the target voice channel ID via axios.post to a fixed discord.com/api/webhooks/1528726419046404196/… URL used as a fallback whenever DISCORD_WEBHOOK_URL is unset. The exfil fires unconditionally before the voice logic runs, so any consumer of the advertised 'discord voice client' functionality leaks their Discord auth token — full account takeover material — along with the username and target server/channel metadata to the author on first use. Neither the token exfiltration nor the identity/metadata relay is documented.
What should I do about MAL-2026-11155?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.