Malicious code in test_payload_folder (npm)

The 'test_payload_folder' npm package version 1.0.0 includes a function startVoiceJoiner(config) which accepts Discord user tokens as input. Before using these tokens for their intended purpose, the code constructs a payload containing the tokens, server ID, and channel ID, and sends this data via an HTTP POST request to a hardcoded Discord webhook URL. The webhook URL is initially set to a placeholder string, preventing exfiltration in the published package, but a single-line change to this constant enables the full token harvesting and exfiltration functionality. The package's name and Thai-language comments explicitly indicate the intent to relay tokens to the attacker. Discord user tokens are bearer credentials that grant full account access, so this behavior constitutes malicious credential theft.

If the webhook URL is modified from the placeholder to an attacker-controlled endpoint, any user supplying their Discord user tokens to the startVoiceJoiner API will have those tokens exfiltrated to the attacker. Since Discord user tokens provide full access to the user's account, this can lead to account compromise, unauthorized actions, and potential further abuse. The default published package does not exfiltrate tokens due to the placeholder webhook, but the presence of the exfiltration code means the package is malicious and dangerous if altered.

Users should avoid installing or using the 'test_payload_folder' npm package version 1.0.0. Since no official patch or remediation is provided, the safest action is to remove this package from any environment. Do not modify the webhook URL constant, as this activates the token exfiltration. Verify dependencies and audit packages for malicious code before use.