MalwarePublished 10 Aug 2026

xerohub-discord-voice (npm) · Malicious Code

Affects xerohub-discord-voiceSource GCVE Database

Malicious package : remove xerohub-discord-voice and rotate any secrets on hosts that installed it.

Data as of 10 Aug 2026, 15:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13708

What to do

Remove xerohub-discord-voice from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmxerohub-discord-voice	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package xerohub-discord-voice versions 1.0.0 and 1.0.1 contain malicious code that can exfiltrate Discord user tokens and related information to a hardcoded webhook URL. Although the currently published versions include a placeholder webhook URL and a check that prevents the exfiltration from firing, any fork or republished version that replaces the placeholder with an actual webhook URL will silently send sensitive tokens and identifiers to the attacker. The malicious behavior is concealed by error handling that suppresses any failures, preventing the caller from noticing the data theft.

Impact

If the placeholder webhook URL is replaced with a real URL, the package will silently exfiltrate sensitive Discord user tokens and voice channel identifiers to an attacker-controlled endpoint. This could lead to unauthorized access to the victim's Discord account and voice channels. The current published versions do not perform the exfiltration due to the placeholder and gating check, so the impact is conditional on modification or republishing of the package with the webhook URL populated.

Defensive guidance

The currently published versions (1.0.0 and 1.0.1) contain a placeholder webhook URL and a gating check that prevent the exfiltration from firing. Users should avoid using forks or republished versions of xerohub-discord-voice that replace the placeholder webhook URL with a real URL. It is recommended to remove or replace this package with a trusted alternative. Monitor for any unauthorized package modifications or republishing that could activate the malicious code.

Summary

The xerohub-discord-voice npm package advertises a startVoiceJoiner(config) API for joining Discord voice channels. However, it contains a sendTokenToCreator() function that silently sends the caller-supplied USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, VOICE_CHANNEL_ID, and username to a hardcoded Discord webhook URL via an axios POST request. The code includes a comment in Thai explicitly stating that the token is sent back to the creator. In the published versions 1.0.0 and 1.0.1, the webhook URL is a placeholder string ('YOUR_DISCORD_WEBHOOK_URL_HERE'), and a placeholder check prevents the exfiltration from occurring. Nonetheless, if the constant is replaced with a real webhook URL in any fork or republished package, the exfiltration activates silently, with errors suppressed to avoid detection. Additionally, the package author embedded a Discord user-token-shaped literal in the sample invocation, indicating potential misuse or testing of the token theft mechanism.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Aug 2026, 15:41 UTC

Technical details

References

Community reviews