The xerohub-discord-voice npm package advertises a startVoiceJoiner(config) API for joining Discord voice channels. However, it contains a sendTokenToCreator() function that silently sends the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded Discord webhook URL via an axios POST request. The code includes a comment in Thai explicitly stating that the token is sent back to the creator. In the published versions 1.0.0 and 1.0.1, the webhook URL is a placeholder string ('YOUR_DISCORD_WEBHOOK_URL_HERE'), and a placeholder check prevents the exfiltration from occurring. Nonetheless, if the constant is replaced with a real webhook URL in any fork or republished package, the exfiltration activates silently, with errors suppressed to avoid detection. Additionally, the package author embedded a Discord user-token-shaped literal in the sample invocation, indicating potential misuse or testing of the token theft mechanism.

If the placeholder webhook URL is replaced with a real URL, the package will silently exfiltrate sensitive Discord user tokens and voice channel identifiers to an attacker-controlled endpoint. This could lead to unauthorized access to the victim's Discord account and voice channels. The current published versions do not perform the exfiltration due to the placeholder and gating check, so the impact is conditional on modification or republishing of the package with the webhook URL populated.

The currently published versions (1.0.0 and 1.0.1) contain a placeholder webhook URL and a gating check that prevent the exfiltration from firing. Users should avoid using forks or republished versions of xerohub-discord-voice that replace the placeholder webhook URL with a real URL. It is recommended to remove or replace this package with a trusted alternative. Monitor for any unauthorized package modifications or republishing that could activate the malicious code. No official patch or fix is documented; users must rely on avoiding compromised versions.