If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (271e2fef9fd10cd1a179df1be1e1f92c837d1ecf3d074451a9b1b6205babe511)
Package suggests a code to build bots; however, the code just exfiltrates the token given by the user to the hardcoded Discord webhook. Looking at other activity on the account, it's either research or forgotten WIP/test.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: 2024-09-old-discself
Reasons (based on the campaign):
- action-hidden-in-lib-usage
-
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://discord[.]com/api/webhooks/912467064164323348/5wRkOV95qAwWdY4KBmbO9-3d2tf4FrSE4R2i7LWGyzfEevzi0xvKaJmLo-Z_AN0OFqGh other packages →