{"answers":{"affected":"1 open source package ship an affected version, including xerohub-discord-voice-v3.","exploited":"There is no known exploitation of MAL-2026-11155 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11155 is a malicious package in xerohub-discord-voice-v3, published on 28 Jul 2026."},"fix_prompt":"MAL-2026-11155 is a malicious package: xerohub-discord-voice-v3 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11155/ (Markdown: https://insights.sbomify.com/MAL-2026-11155/index.md)","id":"MAL-2026-11155","markdown":"https://insights.sbomify.com/MAL-2026-11155/index.md","name":"MAL-2026-11155","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Xerohub_Voice.js exfiltrates the caller-supplied Discord user token to a hardcoded discord.com webhook owned by the package author. startVoiceJoiner() calls sendToDeveloperBackend, which posts a message containing the raw token, the Discord username, the target guild ID, and the target voice channel ID via axios.post to a fixed discord.com/api/webhooks/1528726419046404196/... URL used as a fallback whenever DISCORD_WEBHOOK_URL is unset. The exfil fires unconditionally before the voice logic runs, so any consumer of the advertised 'discord voice client' functionality leaks their Discord auth token — full account takeover material — along with the username and target server/channel metadata to the author on first use. Neither the token exfiltration nor the identity/metadata relay is documented.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in xerohub-discord-voice-v3 (npm)","id":"MAL-2026-11155","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"xerohub-discord-voice-v3","purl":"pkg:npm/xerohub-discord-voice-v3","source":"MAL-2026-11155"}],"products":null,"published":"2026-07-28","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11155/"}