MAL-2026-11050

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/discordnv/MAL-2026-11050.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11050
Published
2026-07-24T19:14:19Z
Modified
2026-08-04T22:05:26.023750145Z
Summary
Malicious code in discordnv (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48)

On import discordnv, init.py invokes mainentry() which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite stores to extract Discord authentication tokens, reads and DPAPI-decrypts Roblox robloxcookies.dat, and POSTs the harvested credentials to a hardcoded Discord webhook at discord.com/api/webhooks/1528403989983662194/... and a Google Apps Script endpoint at script.google.com/macros/s/AKfycbwa.../exec. addto_startup() writes an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named discordnv pointing at the invoking Python/exe so the stealer re-runs on every user logon. All operations are wrapped in bare try/except to swallow errors and avoid alerting the user. The package's advertised purpose (a Roblox DataStore helper) is unrelated to the observed behavior.

Source: kam193 (d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646)

The package exfiltrates Roblox cookies and Discord tokens from the victim machine.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-spaysrbdata

Reasons (based on the campaign):

  • infostealer
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-24T20:00:55.33292447Z",
            "sha256": "d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646",
            "modified_time": "2026-07-24T19:14:19.186455Z",
            "source": "kam193",
            "id": "pypi/2026-06-spaysrbdata/discordnv",
            "versions": [
                "0.8.0"
            ]
        },
        {
            "import_time": "2026-08-04T21:33:15.106832632Z",
            "sha256": "2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48",
            "modified_time": "2026-08-04T21:25:16Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011050",
            "versions": [
                "0.8.0"
            ]
        }
    ],
    "iocs": {
        "urls": [
            "https://script.google.com/macros/s/AKfycbwa8sLEdsG_leFVecuc_dFrZ_h5JnZKrWxXWazK1T6DoKGAGG5OJ9rznwYXg2PS-h1d/exec",
            "https://discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX7xnsJ9hz6DKaBgSe_Ur2FIgSJMHlusBwx",
            "https://discord.com/api/webhooks/1528403989983662194/qCwXL7KBSqFwpzz5RWPp1eCKZlqWa-lGBGZ3z4iDl_oaEFkG9EGXJTneA5LIHDUDrkFF"
        ]
    }
}
References
Credits

Affected packages

PyPI / discordnv

Package

Name
discordnv
View open source insights on deps.dev
Purl
pkg:pypi/discordnv

Affected ranges

Affected versions

0.*
0.8.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/discordnv/MAL-2026-11050.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "f2f92b82d6be2914c2f3efc6c0f788f7673f076c801aae0f2392b25b847431c3",
            "path": "discordnv/__init__.py",
            "tlsh": "79e055a5983929be5459e369d8941b1db05300babbb1021122a8bf3b29f28618d3831e"
        },
        {
            "sha256": "3c60a2a6df49e1a312815e2b323d5683704cf09b1a10b6843cbbe3d40950628f",
            "tlsh": "ae426653dc4a041a9636915da856e908fb2706bb757113033efca7ac3fb5021d3b91ee",
            "path": "discordnv/main.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "discordnv-0.8.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "84ee449bbd50e05910b61dd30d847fc95de99e4b36dcfd0e03a6aaec5f5b44b6",
                "sha256": "a391fcbfdc7add9836a1bcdf53832270bd66924dfec897948829111ad45479b0",
                "md5": "462133757b5631b4cd13dff4952aa4fe"
            }
        },
        {
            "filename": "discordnv-0.8.0.tar.gz",
            "hashes": {
                "blake2b_256": "0a2015466ddf6b8ed8c577aaa3c65b165d481de3d9e2b911ce13ce73d8f346c6",
                "sha256": "15e5339d89b0a8cbf4d87ec882d2d614a5bff984ec4d40f82945147d07d05c50",
                "md5": "83e02d9cc2819f9720351297cf1be3eb"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]