If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: kam193 (fa2242ec1849ffa55a55c85b7781623cdc7147b8568b3beaa5d2b3b956c04e17)
Code provides a Discord bot, which - once a generic command is called - performs malicious action against the Discord server: deletes all channels, renames the server, and then starts a loop that creates spamming channels and notifies everyone.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-old-noteasonfnsource
Reasons (based on the campaign):
- abusing-3rd-api
- other