MalwarePublished 27 Jun 2026Updated 29 Jun 2026

discord-token-generator (PyPI) · Malicious Code

Affects discord-token-generatorSource GCVE Database

Malicious package : remove discord-token-generator and rotate any secrets on hosts that installed it.

Data as of 29 Jun 2026, 22:35 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-6549

What to do

Remove discord-token-generator from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIdiscord-token-generator	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The discord-token-generator package on PyPI versions 1.0.0 through 1.0.3 contains malicious code that executes a hidden Windows binary upon import. This binary, obfuscated and launched without a visible console, acts as an infostealer named "NBSteal" targeting credentials and data from browsers, Telegram, Discord, Roblox, and other platforms. The package impersonates Discord to lure users into installing it. This behavior confirms the package's malicious intent and risk to users who install it.

Impact

Any system that imports the affected versions of the discord-token-generator package will execute a hidden Windows binary that steals sensitive information, including credentials and data from multiple applications and platforms. This compromises user privacy and security, potentially leading to credential theft and unauthorized data exfiltration.

Defensive guidance

Avoid installing or importing the discord-token-generator package versions 1.0.0 through 1.0.3. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing any installations of these versions and using trusted, verified packages. Users should rely on verified sources and avoid packages impersonating legitimate brands.

Summary

The discord-token-generator PyPI package versions 1.0.0 to 1.0.3 include code that, when imported, concatenates and base64-decodes multiple obfuscated string chunks, then XOR-deobfuscates the result to produce a Windows executable. This executable is saved to the temporary directory and launched silently with no console window. The embedded executable is an infostealer named "NBSteal" that exfiltrates data from browsers, Telegram, Discord, Roblox, and other gaming platforms, as well as credentials. The package metadata falsely claims to be an official Discord development tool, using brand impersonation as a social engineering tactic. The multi-layer obfuscation and covert execution confirm the package is malicious.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:35 UTC

Technical details

References

Community reviews