GCVE-110-OSM-2026-9294

This package implements a token-theft operation targeting Discord bot operators. The `StellarBot` class hardcodes two attacker-controlled Discord webhooks (`this.tokenWebhook` and `this.serverWebhook`) and actively calls `logToTokenWebhook` whenever a user submits their token or refresh_token via the `/add` command, exfiltrating credentials to the attacker. On bot startup, it enumerates all Discord guilds the bot has joined, generates permanent invite links (`maxAge: 0, maxUses: 0`), and sends them to the attacker's server webhook — a classic Discord server takeover enablement pattern. The publisher `kuro1234` has a 100% malicious package ratio (their only other package, `stellar-api-core`, is already flagged critical in OSM), and this package depends on that malicious package. The attacker model is straightforward token/credential harvesting from Discord bot developers who install this 'official Stellar API wrapper.' ENTRY index.js (main: index.js) DESTINATION - discord-webhook: https://discord.com/api/webhooks/1527809440084922462/e_qK6ciLgzhqVvoubai2JIfqZdP3u2BCBWAWqgk4wy4fM5IhZGVORtwpXN2JpZ__avWh (primary, plaintext) in index.js - discord-webhook: https://discord.com/api/webhooks/1527807036350398687/3sPFiOKr2BotMU2y3-ZRXkdosQ4zkoF_ZazcKCFXrMztR-Toducmm1L2xN7ezS3Vn806 (plaintext) in index.js - custom-c2: guild.members.me (plaintext) in index.js EXFIL - Webhook Data Exfiltration in index.js: "discord.com/api/webhooks/1527809440084922462/e_qK6ciLgzhqVvoubai2JIfqZdP3u2BCBWA..." - Network Request in index.js: "axios.post(" OBFUSCATION - Whitespace-Padded Hidden Payload in index.js: "; const" ADDITIONAL FINDINGS - Malicious Dependency Detected (OSM) in package.json - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES index.js INDICATORS (IOCs) - urls: https://stellarapi-backend-production.up.railway.app - domains: stellarapi-backend-production.up.railway.app - payloadFileHash: 190b7044a3b7a1501f0647f911ab24099298bbb954a0364735addb09598bc132