The discord-token-generator PyPI package versions 1.0.0 to 1.0.3 include code that, when imported, concatenates and base64-decodes multiple obfuscated string chunks, then XOR-deobfuscates the result to produce a Windows executable. This executable is saved to the temporary directory and launched silently with no console window. The embedded executable is an infostealer named "NBSteal" that exfiltrates data from browsers, Telegram, Discord, Roblox, and other gaming platforms, as well as credentials. The package metadata falsely claims to be an official Discord development tool, using brand impersonation as a social engineering tactic. The multi-layer obfuscation and covert execution confirm the package is malicious.

Any system that imports the affected versions of the discord-token-generator package will execute a hidden Windows binary that steals sensitive information, including credentials and data from multiple applications and platforms. This compromises user privacy and security, potentially leading to credential theft and unauthorized data exfiltration.

Avoid installing or importing the discord-token-generator package versions 1.0.0 through 1.0.3. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing any installations of these versions and using trusted, verified packages. No official patch or fix exists because the package itself is malicious. Users should rely on verified sources and avoid packages impersonating legitimate brands.