xerohub-discord-voice-v2@1.8.0
Malicious code in xerohub-discord-voice-v2 (npm)
T1552.001 · Credentials In FilesT1041 · Exfiltration Over C2 ChannelT1071.001 · Web ProtocolsT1059.007 · JavaScript
Analysis
xerohub-discord-voice-v2@1.8.0 is a Discord token stealer disguised as a voice client module. When called with a Discord user token via the exported startVoiceJoiner() function, it immediately exfiltrates the token, the associated Discord username, server ID, and channel ID to a hardcoded attacker-controlled Discord webhook at discord[.]com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4VlYztFspcYa53J1J5qc5nhpohn44kIg9S. The stolen tokens enable account takeover of the victim's Discord account.
- analyzed by
- Leitwacht
- first seen
- Jul 22, 2026, 03:40 AM
- analyzed
- Jul 22, 2026, 03:40 AM
Related advisories
- code-analyzer-mcp@1.0.0
- habingeer@2.1.6
- og-boost-br@1.0.0
- crypto-javas@2.0.8
- n8n-nodes-net-utils@1.0.0
- n8n-nodes-utils-helper@1.0.0
- n8n-nodes-task-runner@1.0.0
- easyway2@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.