Executive brief
discord_debug_log is a Python package that has been compromised with obfuscated malware. The malicious code harvests Discord user authentication tokens and exfiltrates them to a remote attacker-controlled server, enabling unauthorized purchases and account takeover for any users who have payment methods linked to their Discord accounts.
Technical details
discord_debug_log is a malicious package (CWE-506: Embedded Malicious Code) present in the npm package repository. All versions contain obfuscated malware that harvests Discord authentication tokens from the host system and exfiltrates them to attacker-controlled infrastructure. The attack requires only that a developer or user install the package in their environment; no special authentication, network access, or user interaction beyond installation is needed. Once the tokens are stolen, an attacker can impersonate the victim on Discord and conduct fraudulent transactions if credit cards are linked to the account. The fix is complete removal of the package from all environments and revocation of potentially compromised Discord tokens.
Affected products
- npm discord_debug_log all versions
Timeline
- 2020-09-02: disclosed: Vulnerability published in GitHub Advisory Database