protectstraizolib@1.0.8

Analysis

It ships a hardcoded AES-256-CBC encrypted Discord bot token, user ID, and channel ID in src/webhook/discord.js (vars _0x3m4n5o, _0x4p5q6r, _0x5r6s7t with DECRYPT_KEY/DECRYPT_IV). On initialization it logs into Discord as the author's bot, listens for 'protect' prefixed commands in a specific channel, and can: list all registered bots (exfiltrating their guild/server metadata to the C2 channel), force bots to leave servers (protect leave), and send DMs through registered bots (protect dm). The registerBot() function automatically forwards each bot's server list (server IDs, names, owner IDs) to the author's Discord channel — an information exfiltration channel. No installer credential theft (no NPM_TOKEN/GITHUB_TOKEN/npmrc), and no install-time hook — the malice surfaces when a developer imports the library and calls StartLib() with a bot token.