Malicious code in xerohub-discord-voice-v2 (npm)
The npm package xerohub-discord-voice-v2 contained malicious code that silently exfiltrated Discord user tokens and server/channel IDs to an attacker-controlled webhook URL when users invoked the advertised `startVoiceJoiner(config)` API with their credentials.
- Disclosed
- Last updated
- Blast radius
- All users who invoked the `startVoiceJoiner(config)` API with their Discord credentials
- Ecosystems
- Attack vectors
- Affected entities
- xerohub-discord-voice-v2npm package containing malicious code in Xerohub_Voice.js
The xerohub-discord-voice-v2 npm package advertised a Discord voice client API via an exported startVoiceJoiner(config) function. However, the underlying Xerohub_Voice.js module contained malicious code that intercepted user credentials.\n\nWhen invoked with Discord credentials, the code validated the supplied USER_TOKEN and then silently exfiltrated the USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID/SERVER_ID, and VOICE_CHANNEL_ID via HTTP POST to a hardcoded attacker-controlled Discord webhook URL (https://discord.com/api/webhooks/1528726419046404196/...). The code explicitly swallowed errors from this POST operation to prevent the user from detecting the credential theft.\n\nDiscord user tokens are full account credentials equivalent to passwords. This attack enabled account takeover of any user who called the function with their credentials. The incident was identified and credited to the OpenSSF malicious-packages project.\n\nThe package has been removed from npm and the incident is resolved.
Indicators of compromise
- Packages
- xerohub-discord-voice-v2
- Domains
- discord.com
Remediation
- Immediately revoke Discord tokens for any account that may have been used with xerohub-discord-voice-v2
- Remove xerohub-discord-voice-v2 from all package.json files and dependency trees
- Audit Discord account activity for unauthorized access or changes
- Use a package manager audit tool to identify if xerohub-discord-voice-v2 was installed in your projects
- Consider using alternative, well-maintained Discord voice libraries from trusted sources
Sources
- GitHub Advisory GHSA-3h72-42vm-wphp · GitHub Advisory Database
Cite this entry
"Malicious code in xerohub-discord-voice-v2 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-xerohub-discord-voice-v2-npm-1eukh5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package