It actually gives 4 of them now, but they may be false positives. He's using JSDefender to most likely protect his code, however, I am not going to trust a program that uses discord.js's selfbot that takes your Discord token and has full access to do whatever, behind obfuscated code.