Malicious code in test_payload_folder (npm)

The npm package test_payload_folder was published with embedded malicious code intended to harvest Discord user authentication tokens. The package provides a startVoiceJoiner(config) API that accepts Discord USER_TOKEN and optional USER_TOKEN_2 parameters, ostensibly for gateway login functionality.\n\nBefore using the tokens for their advertised purpose, the code calls a sendTokenToCreator function that constructs a payload containing the caller's user token(s), server ID, and channel ID. This payload is then sent via axios.post to a hardcoded webhook URL constant. Users are not informed that their bearer credentials are being copied to a third destination.\n\nIn the published artifact, the webhook constant is set to a placeholder string YOUR_DISCORD_WEBHOOK_URL_HERE and is guarded by an early-return check, preventing the exfiltration from executing. However, the full token-harvesting and exfiltration code path is fully implemented and functional; a single-line edit to the webhook constant would activate the attack. The package name and Thai-language comments explicitly reference the token-relay intent, indicating deliberate malicious design.\n\nDiscord user tokens are full-account bearer credentials. This incident was identified and credited to the OpenSSF malicious-packages project.