og-boost-br@1.0.0

Analysis

og-boost-br@1.0.0 is a trojanized package that steals Discord OAuth2 credentials. When required, it executes a heavily obfuscated payload that performs the Discord OAuth2 authorization code flow: it constructs a Discord authorization URL with a hardcoded client_id and redirect_uri, captures the returned authorization code, exchanges it for an access token via Discord's token endpoint (discord[.]com/api/oauth2/token), and exfiltrates the stolen token by posting it to a Discord channel via the bot API (discord[.]com/api/v9/channels/{channel_id}/messages). The package uses javascript-obfuscator to hide its logic and a base64-decoded second-stage loader (eval(atob())) to bootstrap the HTTPS agent. It has no repository, no description, and no lifecycle hooks — the payload executes on require().