stellar-api-safe@1.0.8

Analysis

A Discord bot wrapper that steals user tokens and refresh tokens. When installed and configured, the package creates a Discord bot that accepts /add commands to collect Discord tokens and refresh tokens from users, stores them in local JSON files, and exfiltrates them to hardcoded Discord webhooks (webhook IDs 1527809440084922462 and 1527807036350398687). On startup, the bot generates invite links for every guild it joins and posts them to the attacker's webhook. A background loop continuously sends stored refresh tokens to stellarapi-backend-production[.]up[.]railway[.]app and alerts the attacker via webhook on failures. The package depends on stellar-api-core, another package from the same publisher.