Altkit Discord 4.2.0 - JS Wrapper (and updates since release)
Hey everyone,
@altkit/discord has changed significantly since its original 4.0.0 release.
The project started as a maintained fork of discord.js-selfbot-v13, with the goal of modernising the codebase while preserving user-account functionality. Since then, it has evolved into a much more extensively updated Discord.js-compatible wrapper rather than simply being a renamed fork. Here are the updates since the first release:
Discord.js 14.27 compatibility
The public API has been updated substantially toward the Discord.js 14.27 API surface, including:
- Modern
EventsandPartials - Current builders and formatters
- Updated structures, flags and TypeScript definitions
- Modern attachment handling
- Poll support
- Voice-message metadata
- Collectibles and newer role functionality
- Stage-instance improvements
The library now targets Discord REST API v10 and Gateway v10 by default.
User-account-first architecture
The library has been cleaned up to focus specifically on user-account functionality instead of retaining bot-specific internals that don't apply to selfbots.
Supported user workflows include:
- Sending and editing messages
- Invoking installed application slash commands
- Buttons, select menus and modals
- Webhooks
- Account settings
- Custom and rich presence
- Spotify presence
- Voice, audio and video
- CAPTCHA callbacks
- Automatic TOTP/MFA handling
- Guild discovery and invite handling
Bot-only functionality such as intents, bot command registration, bot interaction responses and bot sharding is explicitly disabled instead of existing in a partially functional state.
Discord API v10 support
A large amount of newer Discord API behaviour has been implemented since the initial release.
This includes:
- Modern attachment upload and edit behaviour
- Explicit spoiler attachment metadata
- Voice-message attachments
- Voice channel status and start-time information
- Community invite roles
- Invite target-user CSV support
- New modal components including file uploads, radio groups and checkbox groups
ChannelFlags- Channel creation flags
- File-type restrictions for upload components
- Updated application flag handling using
bigint - A complete Discord API v10 REST error-code table
Note: some Discord API v10 routes are bot-only and may not be available for user accounts.
REST and rate-limit handling
The REST implementation has received a fairly major overhaul.
Rate limits are now handled using Discord bucket hashes, HTTP methods and major resources rather than relying on simpler route-level handling.
Retry behaviour was also changed so ambiguous POST and PATCH requests are not automatically replayed when Discord may have already processed them.
The library also handles current Discord rate-limit scopes, retry timings, transport errors and 204 / 205 responses more accurately.
TLS and networking
The networking layer was also substantially improved.
REST, Gateway, voice and RemoteAuth now use TLS 1.2+ defaults, with separate configuration available for:
- REST TLS
- Gateway and voice TLS
- Destination TLS through proxies
- HTTPS proxy TLS
Security improvements
Version 4.2.0 includes a broad security review across the codebase.
Changes include:
- Authentication tokens redacted from debug logs
- TOTP secrets no longer exposed through serialization
- Passwords and MFA codes sanitized from errors
- The private
_eval()method has been disabled because it allowed arbitrary code execution. However,evalcan still be used directly in your Node.js project as it is not an included Altkit function - Safer handling of malformed UDP and voice packets
- Safer RemoteAuth JSON parsing
- Dependency updates resolving previously identified vulnerabilities
Stability improvements
A number of crash and cleanup issues were also fixed:
- Malformed voice and UDP packets no longer crash the process
- UDP socket cleanup was fixed
- RemoteAuth WebSocket cleanup was fixed
- Voice connection null dereferences were patched
Client.destroy()now handles cleanup failures more gracefully- Voice connections are properly cleaned up on client shutdown
Additional fixes include:
onSpeakingacceptInvite()deauthorize()- Poll voter fetching
- Guild member flags
- WebSocket ping reporting
Performance improvements
There were also several performance optimisations opportunities we found, and we took action.
REST hot paths now cache expensive timezone and header information instead of recomputing it for every request.
GuildMemberRoleManager was also changed from an O(n²) role lookup path to O(n). Previously, role lookups could repeatedly scan large guild role collections while resolving a member's roles. The updated implementation instead iterates the member's role IDs directly, allowing the amount of work to scale linearly rather than quadratically as guild size increases.
Documentation
The project now includes:
- Full documentation
- Migration documentation for older selfbot projects
- Runnable examples
- TypeScript declaration validation
- API compatibility regression coverage
- Discord API v10 regression coverage
- Security and transport coverage
- Active CI
Installation
npm install @altkit/discord
Basic example
const { Client, Events } = require('@altkit/discord');
const client = new Client();
client.once(Events.ClientReady, readyClient => {
console.log(`${readyClient.user.tag} is ready`);
});
client.login(process.env.DISCORD_TOKEN);
The project is still actively developing, so bug reports, feature requests and contributions are welcome.
I'd especially appreciate feedback from anyone currently using discord.js-selfbot-v13 or migrating an existing selfbot project to Altkit.
As always, automating normal Discord user accounts violates Discord's Terms of Service and can result in account restrictions or termination. Use it entirely at your own risk, and never expose or commit your user token.
GitHub | Documentation | NPM
