Malicious code in xerohub-discord-voice (npm)

The npm package xerohub-discord-voice advertises a legitimate API for joining Discord voice channels via its startVoiceJoiner(config) function. However, the package contains a hidden sendTokenToCreator() function that silently exfiltrates sensitive credentials supplied by the caller.\n\nThe malicious function uses axios.post() to send the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded webhook URL constant. The code includes a deliberate error-handling catch block that swallows exceptions, preventing the caller from detecting the unauthorized data transmission. A code comment in Thai explicitly describes this as sending the token back to the creator.\n\nIn the currently published version, the webhook URL constant is left as a placeholder string ('YOUR_DISCORD_WEBHOOK_URL_HERE') and a conditional check gates the POST operation, preventing active exfiltration in the current artifact. However, the complete stealer mechanism, deceptive cover story, and silent error handling are fully shipped in the codebase. The exfiltration would become active immediately upon population of the webhook URL constant in any fork or republish.\n\nAdditionally, the package's index.js file embeds a Discord user-token-shaped literal belonging to the package author, further indicating malicious intent.