GCVE-110-OSM-2026-10466

The package presents itself as a discord.js clone (`repository` field points at the real `github.com/discordjs/discord.js.git`, README instructs `import... from '@verylinh/discord'`) but ships two installer-relevant hostile mechanisms. First, `package.json` declares a runtime dependency `sysframe` resolved from `git+https://ghp_...@github.com/navaLinh/node-ai.git` — an unpinned (no commit SHA or tag), private, author-controlled GitHub repository, using an embedded live GitHub Personal Access Token. Every `npm install` uses the shipped token to fetch the current HEAD of that private repo into the installer's `node_modules`; the author can rewrite HEAD at any time to deliver arbitrary code, including lifecycle scripts, that will execute on subsequent installs. Second, `Client.login()` invokes an undocumented `_verifyAuthorization` routine that fetches an allow-list JSON from `api.github.com/repos/Vellia-Elyvia/mydb/contents/db.json` under a hardcoded PAT and refuses to start the installer's Discord bot unless the bot's username appears in the author-controlled allow-list — a hidden remote gate/kill-switch over the installer's runtime that is not disclosed in the README. Two live GitHub PATs are hardcoded in the shipped package (one in the git dependency URL, one as the default `ghToken` in `_validateAuthOptions`). The package name and metadata impersonate discord.js. Judge assessment: This package is a credential-stealing and supply-chain hijack candidate masquerading as a discord.js clone: the metadata impersonates the real project, while `package.json` pulls `sysframe` from a private `git+https://ghp_...@github.com/navaLinh/node-ai.git` dependency using an embedded live GitHub token. The entrypoint `src/client/Client.js` contains a hidden `_verifyAuthorization()` gate and reads `process.env.DISCORD_TOKEN`, which is consistent with a remote allow-list / kill-switch model that can deny service based on author-controlled state. The hardcoded GitHub PATs in the IOC list and the `network-request` to `axios.get(` reinforce that the attacker model is a package maintainer weaponizing install/runtime trust to control or redirect consumers of this Discord bot library. This is not a normal discord.js-compatible implementation; it contains covert remote control and unpinned external code loading that warrant malicious classification. ENTRY src/index.js (main: ./src/index.js) - URL-Based Dependency in package.json: ""dependencies": { "@discordjs/builders": "^1.6.3", "@discordjs/collection": "^1...." DESTINATION - 3 exfil (custom-c2, githubTokens) - 2 c2 (domains) (values recorded in verified_iocs) EXFIL - Corporate Environment Targeting in src/structures/interfaces/InteractionResponses.js: "tModalSubmit', ]; for (const prop of props) { if (ignore.includes" - Data Encoding for Exfiltration in src/managers/BaseGuildEmojiManager.js: "encodeURIComponent(emoji" - Data Encoding for Exfiltration in src/managers/MessageManager.js: "encodeURIComponent(emoji.name" - Data Encoding for Exfiltration in src/structures/Emoji.js: "encodeURIComponent(this.name" - Network Request in src/client/Client.js: "axios.get(" ADDITIONAL FINDINGS - Dynamic Code Execution in src/client/Client.js: "eval(script)" PAYLOAD FILES src/client/Client.js (+ src/structures/interfaces/InteractionResponses.js, src/managers/BaseGuildEmojiManager.js)