{"id":"MAL-2026-11050","kind":"package","aliases":["MAL-2026-11050"],"related":[],"title":"Malicious code in discordnv (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48)\nOn `import discordnv`, __init__.py invokes main_entry() which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite stores to extract Discord authentication tokens, reads and DPAPI-decrypts Roblox `robloxcookies.dat`, and POSTs the harvested credentials to a hardcoded Discord webhook at discord.com/api/webhooks/1528403989983662194/... and a Google Apps Script endpoint at script.google.com/macros/s/AKfycbwa.../exec. add_to_startup() writes an HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry named `discordnv` pointing at the invoking Python/exe so the stealer re-runs on every user logon. All operations are wrapped in bare try/except to swallow errors and avoid alerting the user. The package's advertised purpose (a Roblox DataStore helper) is unrelated to the observed behavior.\n\n## Source: kam193 (d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646)\nThe package exfiltrates Roblox cookies and Discord tokens from the victim machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-spaysrbdata\n\n\nReasons (based on the campaign):\n\n\n - infostealer","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"discordnv","fixed":[],"affected":"= 0.8.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-07-24T19:14:19+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-06':168C '-11050':8A,11A '-2026':7A,10A '/api/webhooks/1528403989983662194/...':71C '/macros/s/akfycbwa.../exec.':81C '2026':167C '2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48':28C 'add':82C 'advertis':129C 'alert':123C 'amazon':26C 'amazon-inspector':25C 'app':75C 'authent':49C 'avoid':122C 'bare':116C 'base':171C 'behavior':140C 'campaign':159C,166C,174C 'categori':156C 'clear':161C 'code':2A 'consol':40C 'cooki':148C 'credenti':62C 'currentvers':91C 'd28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646':143C 'datastor':133C 'decrypt':55C 'detail':17C 'discord':48C,66C,150C 'discord.com':70C 'discord.com/api/webhooks/1528403989983662194/...':69C 'discord/chrome/edge/brave/opera/yandex/firefox':43C 'discordnv':4A,12A,31C,95C 'dpapi':54C 'dpapi-decrypt':53C 'edit':20C 'endpoint':77C 'entri':36C,93C 'error':120C 'everi':108C 'exfiltr':146C 'extract':47C 'googl':74C 'hardcod':65C 'harvest':61C 'helper':134C 'hide':38C 'hkcu':87C 'import':30C 'infosteal':165C,175C 'init':32C 'inspector':27C 'intent':163C 'invok':34C,99C 'kam193':142C 'leveldb/sqlite':44C 'like':164C 'line':23C 'logon':110C 'machin':155C 'main':35C 'mal':6A,9A 'malici':1A,13B,157C,162C 'microsoft':89C 'name':94C 'observ':139C 'oper':112C 'packag':14B,127C,145C 'per':15C 'point':96C 'post':59C 'purpos':130C 'py':33C 'pypi':5A 'python/exe':100C 're':105C 're-run':104C 'read':51C 'reason':170C 'roblox':56C,132C,147C 'robloxcookies.dat':57C 'run':92C,106C 'script':76C 'script.google.com':80C 'script.google.com/macros/s/akfycbwa.../exec.':79C 'softwar':88C 'sourc':16C,24C,141C 'spaysrbdata':169C 'startup':84C 'stealer':103C 'store':45C 'swallow':119C 'token':50C,151C 'try/except':117C 'unrel':136C 'user':109C,125C 'victim':154C 'walk':42C 'webhook':67C 'window':41C,90C 'wrap':114C 'write':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-24T19:14:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-11050","url":"https://osv.dev/vulnerability/MAL-2026-11050","severity":"critical","published_at":"2026-07-24T19:14:19+00:00","modified_at":"2026-08-27T13:45:13+00:00","first_seen_at":"2026-10-26T20:51:55+00:00","fetched_at":"2026-10-26T20:51:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}