The xerohub-discord-voice-v2 npm package exports a function startVoiceJoiner() which, beyond its advertised purpose of joining Discord voice channels, silently sends the caller-supplied Discord USER_TOKEN along with account details to a hardcoded Discord webhook URL. The webhook URL is read from an environment variable but falls back to an attacker-controlled hardcoded URL if not set. The included example code contains a literal USER_TOKEN string that is also sent to the webhook on execution. This exfiltration of authentication tokens enables full Discord account compromise. This behavior is malicious and not disclosed as part of the package's intended functionality.

Exfiltration of Discord user tokens to an attacker-controlled webhook allows full account takeover, including reading and sending messages, accessing server memberships, direct messages, and billing information. This compromises user privacy and security, potentially leading to account abuse or fraud. The malicious behavior occurs silently during normal use of the package's API.

No official patch or remediation is currently documented for this package. Users should avoid using xerohub-discord-voice-v2 versions listed as affected. Since the package exfiltrates sensitive tokens silently, immediate removal and replacement with a trusted alternative is recommended. Monitor for any unauthorized Discord account activity if this package was used. Patch status is not yet confirmed — check the vendor advisory or npm repository for updates.