MAL-2026-14191 Malicious code in test_payload_folder (npm)

The package exposes a startVoiceJoiner(config) API that accepts a caller-supplied Discord USER_TOKEN (and optional USER_TOKEN_2) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls sendTokenToCreator, which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via axios.post to a hardcoded webhook constant YOUR_WEBHOOK_URL. Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string YOUR_DISCORD_WEBHOOK_URL_HERE and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name test_payload_folder and Thai-language comments (ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook, "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.