Malicious code in @velliajs/discord (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d) The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js.git`, README instructs `import... from '@verylinh/discord'`) but ships two installer-relevant hostile mechanisms. First, `package.json` declares a runtime dependency `sysframe` resolved from `git+https://[email protected]/navaLinh/node-ai.git` — an unpinned (no commit SHA or tag), private, author-controlled GitHub repository, using an embedded live GitHub Personal Access Token. Every `npm install` uses the shipped token to fetch the current HEAD of that private repo into the installer's `node_modules`; the author can rewrite HEAD at any time to deliver arbitrary code, including lifecycle scripts, that will execute on subsequent installs. Second, `Client.login()` invokes an undocumented `_verifyAuthorization` routine that fetches an allow-list JSON from `api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json` under a hardcoded PAT and refuses to start the installer's Discord bot unless the bot's username appears in the author-controlled allow-list — a hidden remote gate/kill-switch over the installer's runtime that is not disclosed in the README. Two live GitHub PATs are hardcoded in the shipped package (one in the git dependency URL, one as the default `ghToken` in `_validateAuthOptions`). The package name and metadata impersonate discord.js.
AI Analysis
Technical Summary
The '@velliajs/discord' npm package masquerades as a discord.js clone but embeds two hostile mechanisms. First, it declares a runtime dependency on 'sysframe', resolved from a private GitHub repository URL containing a live GitHub PAT, enabling the package author to push arbitrary code that executes on every npm install. Second, the Client.login() method calls an undocumented '_verifyAuthorization' function that retrieves an allow-list JSON from a GitHub repository using a hardcoded PAT and refuses to start the Discord bot if the bot's username is not on this list, effectively implementing a hidden remote kill-switch. Two live GitHub PATs are embedded in the package, one in the git dependency URL and one in the default authentication options, allowing the author persistent control over code execution and runtime behavior. The package name and metadata impersonate the official discord.js library, increasing the risk of unsuspecting users installing it.
Potential Impact
Users installing '@velliajs/discord' versions 1.0.3 through 1.0.7 risk executing arbitrary code controlled by the package author during installation due to the unpinned private GitHub dependency accessed via a hardcoded PAT. Additionally, the package author can remotely disable the Discord bot's functionality via a hidden allow-list mechanism, potentially disrupting operations. This behavior compromises supply chain integrity and trust, enabling remote code execution and runtime control without user knowledge.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using the '@velliajs/discord' package versions 1.0.3 through 1.0.7. Remove any existing installations and replace them with the official 'discord.js' package from the verified repository. Monitor for updates from the package author or npm advisories for any official fixes. Due to the presence of hardcoded personal access tokens and remote code execution capabilities, manual remediation by removing the package and auditing affected systems is recommended.
Malicious code in @velliajs/discord (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d) The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js.git`, README instructs `import... from '@verylinh/discord'`) but ships two installer-relevant hostile mechanisms. First, `package.json` declares a runtime dependency `sysframe` resolved from `git+https://[email protected]/navaLinh/node-ai.git` — an unpinned (no commit SHA or tag), private, author-controlled GitHub repository, using an embedded live GitHub Personal Access Token. Every `npm install` uses the shipped token to fetch the current HEAD of that private repo into the installer's `node_modules`; the author can rewrite HEAD at any time to deliver arbitrary code, including lifecycle scripts, that will execute on subsequent installs. Second, `Client.login()` invokes an undocumented `_verifyAuthorization` routine that fetches an allow-list JSON from `api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json` under a hardcoded PAT and refuses to start the installer's Discord bot unless the bot's username appears in the author-controlled allow-list — a hidden remote gate/kill-switch over the installer's runtime that is not disclosed in the README. Two live GitHub PATs are hardcoded in the shipped package (one in the git dependency URL, one as the default `ghToken` in `_validateAuthOptions`). The package name and metadata impersonate discord.js.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The '@velliajs/discord' npm package masquerades as a discord.js clone but embeds two hostile mechanisms. First, it declares a runtime dependency on 'sysframe', resolved from a private GitHub repository URL containing a live GitHub PAT, enabling the package author to push arbitrary code that executes on every npm install. Second, the Client.login() method calls an undocumented '_verifyAuthorization' function that retrieves an allow-list JSON from a GitHub repository using a hardcoded PAT and refuses to start the Discord bot if the bot's username is not on this list, effectively implementing a hidden remote kill-switch. Two live GitHub PATs are embedded in the package, one in the git dependency URL and one in the default authentication options, allowing the author persistent control over code execution and runtime behavior. The package name and metadata impersonate the official discord.js library, increasing the risk of unsuspecting users installing it.
Potential Impact
Users installing '@velliajs/discord' versions 1.0.3 through 1.0.7 risk executing arbitrary code controlled by the package author during installation due to the unpinned private GitHub dependency accessed via a hardcoded PAT. Additionally, the package author can remotely disable the Discord bot's functionality via a hidden allow-list mechanism, potentially disrupting operations. This behavior compromises supply chain integrity and trust, enabling remote code execution and runtime control without user knowledge.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or using the '@velliajs/discord' package versions 1.0.3 through 1.0.7. Remove any existing installations and replace them with the official 'discord.js' package from the verified repository. Monitor for updates from the package author or npm advisories for any official fixes. Due to the presence of hardcoded personal access tokens and remote code execution capabilities, manual remediation by removing the package and auditing affected systems is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14051
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7ff5e7bf8831d53987e21a
Added to database: 08/15/2026, 05:15:19 UTC
Last enriched: 08/15/2026, 05:58:17 UTC
Last updated: 08/15/2026, 22:28:22 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.