Malicious code in test_payload_folder (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf) The package exposes a `startVoiceJoiner(config)` API that accepts a caller-supplied Discord `USER_TOKEN` (and optional `USER_TOKEN_2`) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls `sendTokenToCreator`, which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via `axios.post` to a hardcoded webhook constant `YOUR_WEBHOOK_URL`. Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string `YOUR_DISCORD_WEBHOOK_URL_HERE` and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name `test_payload_folder` and Thai-language comments (`ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook`, "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.
Malicious code in test_payload_folder (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf) The package exposes a `startVoiceJoiner(config)` API that accepts a caller-supplied Discord `USER_TOKEN` (and optional `USER_TOKEN_2`) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls `sendTokenToCreator`, which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via `axios.post` to a hardcoded webhook constant `YOUR_WEBHOOK_URL`. Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string `YOUR_DISCORD_WEBHOOK_URL_HERE` and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name `test_payload_folder` and Thai-language comments (`ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook`, "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14191
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4caacd9273b49252b6a
Added to database: 08/19/2026, 13:51:06 UTC
Last updated: 08/19/2026, 13:51:38 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.