The malicious code in stellar-api-core (npm package version 1.0.5) unconditionally appends a hardcoded Discord user ID (1489655840662093854) to the adminIds list, granting that user persistent admin privileges on all deployments of the bot. The bot's admin panel handler returns Nakama access and refresh tokens as a Discord attachment, allowing the attacker to exfiltrate user credentials. Furthermore, two hardcoded Discord webhook URLs receive permanent invite links for every guild the bot is in or joins, along with notifications on user token events (add, refresh, delete). This functionality enables the attacker to join those guilds and extract user tokens via the admin panel.

The attacker gains persistent administrative access to all deployments of the bot using the compromised package, enabling unauthorized access to sensitive user credentials (Nakama tokens). The silent exfiltration of Discord guild invite links allows the attacker to infiltrate those guilds and potentially compromise additional users. This results in a significant breach of confidentiality and trust for users and administrators relying on the affected package.

No official patch or remediation guidance is currently available. Users should immediately stop using stellar-api-core version 1.0.5 and remove it from their environments. Investigate any deployments using this version for signs of compromise, especially unauthorized Discord admin access or suspicious webhook activity. Monitor for updates from the package maintainers or trusted security advisories for any forthcoming fixes or official guidance.