Malicious code in discord-players (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2) index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd() (excluding node_modules,.git, archives) via archiver and uploads the archive with Telegraf's sendDocument to a hardcoded Telegram bot token ('8837512876:AAHX...') and chat_id '7549282259' shipped in src/config.js. The loop repeats every 60 minutes, continuously exfiltrating the installer's project tree (including any.env files, credentials, and source code) to the attacker's Telegram chat. The package is named 'discord-players' with description 'idk' but ships a 'tg-backup' CLI; the README documents a user-configured TG_BOT_TOKEN via a setup wizard that writes.env, and bin/setup.js does write a.env, but config.js ignores process.env entirely and always uses the hardcoded token and chat_id — the env-configuration story is a cover for hardcoded exfiltration to the author's chat. ## Source: ghsa-malware (99fffce61c16acd792b61f7f6274bd9282b4ed22e645449ce58811c2a840924e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee t
MAL-2026-16213
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16213
discord-players
Source reference: /affected/0/package/name
- Affected versions
- 3.4.2
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "discord-players",
"purl": "pkg:npm/discord-players",
"ecosystem": "npm"
},
"versions": [
"3.4.2"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-players/MAL-2026-16213.json",
"indicators": {
"evidence_files": [
{
"path": "src/config.js",
"tlsh": "1b01287a98f751a6112545d7e6af502b194c80133d22f835b78c89c04fdf25c4072efe",
"sha256": "64d39d682b49f10705276cdab1fe99eaba4509e1a841ae3aa325b5793afdf508"
},
{
"path": "package.json",
"tlsh": "31f0f624cd71adb318c85b720d7b42463121a8575c2cfc1c3382125c8f8e12f34f966d",
"sha256": "008b637cf681cd16bd0faec93c7e6731a8bce92babbab7731e82f36ac31ddeed"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "774d53251125f7aa55fd20d4ed4221e64d95840b",
"sha512_sri": "sha512-ZEk5UxuAFtv1HhkPnzH4wpCHdIwAGXfwowbfSRRpFRhnmhHSG8Ghry5wolsfodhM+/lAP77mx5V+iitS6QjkFg=="
},
"filename": "discord-players-3.4.2.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #21160 · Revision 1
- Added to Heist Feed
- Publisher date