If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (866092759174b326eced94e3854f31ba300d25d84387348e6b33119f4aa12caf)
The package exposes a `startVoiceJoiner(config)` API that accepts a caller-supplied Discord `USER_TOKEN` (and optional `USER_TOKEN_2`) ostensibly for gateway login. Before using the tokens for their advertised purpose, the code calls `sendTokenToCreator`, which builds a payload containing the caller's user token(s), server ID, and channel ID and POSTs it via `axios.post` to a hardcoded webhook constant `YOUR_WEBHOOK_URL`. Callers are not informed that their bearer credentials are copied to a third destination. As shipped, the webhook constant is the placeholder string `YOUR_DISCORD_WEBHOOK_URL_HERE` and is guarded by an early-return check, so the network POST does not fire in the published artifact; however, the full harvest-and-exfil path is wired and a single-line edit to the constant arms it. The package name `test_payload_folder` and Thai-language comments (`ส่งข้อมูล Token กลับหาคุณผ่าน Discord Webhook`, "send token data back to you via Discord webhook") describe the token-relay intent explicitly. Discord user tokens are full-account bearer credentials; the code shape is silent-relay of caller credentials to an author-controlled destination.