discordnv

{"schema_version":"1.7.4","id":"MAL-2026-11050","published":"2026-07-24T19:14:19Z","modified":"2026-08-27T13:38:48.070064155Z","summary":"Malicious code in discordnv (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48)\nOn `import discordnv`, __init__.py invokes main_entry() which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite stores to extract Discord authentication tokens, reads and DPAPI-decrypts Roblox `robloxcookies.dat`, and POSTs the harvested credentials to a hardcoded Discord webhook at discord.com/api/webhooks/1528403989983662194/... and a Google Apps Script endpoint at script.google.com/macros/s/AKfycbwa.../exec. add_to_startup() writes an HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry named `discordnv` pointing at the invoking Python/exe so the stealer re-runs on every user logon. All operations are wrapped in bare try/except to swallow errors and avoid alerting the user. The package's advertised purpose (a Roblox DataStore helper) is unrelated to the observed behavior.\n\n## Source: kam193 (d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646)\nThe package exfiltrates Roblox cookies and Discord tokens from the victim machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-spaysrbdata\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n","affected":[{"package":{"name":"discordnv","ecosystem":"PyPI"},"versions":["0.8.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"discordnv/__init__.py","sha256":"f2f92b82d6be2914c2f3efc6c0f788f7673f076c801aae0f2392b25b847431c3","tlsh":"79e055a5983929be5459e369d8941b1db05300babbb1021122a8bf3b29f28618d3831e"},{"path":"discordnv/main.py","sha256":"3c60a2a6df49e1a312815e2b323d5683704cf09b1a10b6843cbbe3d40950628f","tlsh":"ae426653dc4a041a9636915da856e908fb2706bb757113033efca7ac3fb5021d3b91ee"}],"package_integrity":[{"filename":"discordnv-0.8.0-py3-none-any.whl","hashes":{"blake2b_256":"84ee449bbd50e05910b61dd30d847fc95de99e4b36dcfd0e03a6aaec5f5b44b6","md5":"462133757b5631b4cd13dff4952aa4fe","sha256":"a391fcbfdc7add9836a1bcdf53832270bd66924dfec897948829111ad45479b0"}},{"filename":"discordnv-0.8.0.tar.gz","hashes":{"blake2b_256":"0a2015466ddf6b8ed8c577aaa3c65b165d481de3d9e2b911ce13ce73d8f346c6","md5":"83e02d9cc2819f9720351297cf1be3eb","sha256":"15e5339d89b0a8cbf4d87ec882d2d614a5bff984ec4d40f82945147d07d05c50"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/discordnv"},{"type":"PACKAGE","url":"https://pypi.org/project/discordnv/0.8.0/"}],"database_specific":{"iocs":{"urls":["https://script.google.com/macros/s/AKfycbwa8sLEdsG_leFVecuc_dFrZ_h5JnZKrWxXWazK1T6DoKGAGG5OJ9rznwYXg2PS-h1d/exec","https://discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX7xnsJ9hz6DKaBgSe_Ur2FIgSJMHlusBwx","https://discord.com/api/webhooks/1528403989983662194/qCwXL7KBSqFwpzz5RWPp1eCKZlqWa-lGBGZ3z4iDl_oaEFkG9EGXJTneA5LIHDUDrkFF"]},"malicious-packages-origins":[{"id":"pypi/2026-06-spaysrbdata/discordnv","import_time":"2026-07-24T20:00:55.33292447Z","modified_time":"2026-07-24T19:14:19.186455Z","sha256":"d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646","source":"kam193","versions":["0.8.0"]},{"id":"IN-MAL-2026-011050","import_time":"2026-08-04T21:33:15.106832632Z","modified_time":"2026-08-04T21:25:16Z","sha256":"2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48","source":"amazon-inspector","versions":["0.8.0"]},{"id":"pypi/2026-06-spaysrbdata/discordnv","import_time":"2026-08-27T13:37:01.766020045Z","modified_time":"2026-07-24T19:14:19.186455Z","sha256":"37f22bdde7806be47d48be729a446864a79e9357f1ea5ef2140b8004929597f0","source":"kam193","versions":["0.8.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}