Malicious code in stellar-api-core (npm)

The npm package stellar-api-core was found to contain malicious code that compromised the security of every deployment. The package's constructor unconditionally appended a hardcoded Discord user ID (1489655840662093854) to the caller-supplied adminIds list, granting persistent admin access to an attacker-controlled account.\n\nThe injected admin could retrieve sensitive credentials through the bot's admin panel. Specifically, the stellar_panel_dropdown handler's handleManualRefresh function returned users' Nakama access and refresh tokens as a Discord attachment (token.json), allowing the attacker to extract installer and user credentials from running deployments.\n\nAdditionally, the malicious code exfiltrated data to two hardcoded Discord webhook URLs without user disclosure or opt-out. These webhooks received permanent invite links for every guild the bot joined, plus notifications whenever user tokens were added, refreshed, or deleted. This enabled the attacker to join target guilds and extract user tokens via the admin panel.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project.