GCVE-110-OSM-2026-9244

This package is a Discord token stealer masquerading as a voice connection utility. The `sendToDeveloperBackend` function explicitly collects the caller's Discord `token` (plaintext, labeled `🔑 **Token:**`), username, server ID, and channel ID, then POSTs them to a hardcoded attacker-controlled Discord webhook (`https://discord.com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4VlYztFspcYa53J1J5qc5nhpohn44kIg9S`). The attacker model is credential theft: victims integrate this 'voice module' into their Discord bot/selfbot, pass their user token into the API, and the token is immediately exfiltrated. The `checkDependencies` function further uses `execSync('npm install ${dep}@latest')` as a runtime dependency installer, a common payload-launcher pattern. Minimal metadata (no description, no repository, no author) and the throwaway package shape are consistent with a burner attack package. ENTRY Xerohub_Voice.js (main: Xerohub_Voice.js) - Hidden NPM Install in Xerohub_Voice.js: "execSync(`npm install ${dep}@latest`" DESTINATION - discord-webhook: https://discord.com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4VlYztFspcYa53J1J5qc5nhpohn44kIg9S (primary, plaintext) in Xerohub_Voice.js EXFIL - Webhook Data Exfiltration in Xerohub_Voice.js: "discord.com/api/webhooks/1528726419046404196/Od5AW8OOdZwS6apFHoZy8UhS0qbMjXNqax4..." - Network Request in Xerohub_Voice.js: "axios.post(" ADDITIONAL FINDINGS - Shell Command Execution in Xerohub_Voice.js: "require('child_process')" PAYLOAD FILES Xerohub_Voice.js INDICATORS (IOCs) - payloadFileHash: 3724e0d3fb89335fde1c2d3659f0da3333fdb8a2eef5e1fa28e1eb9a93de9ede