Malicious code in discordnv (PyPI)

The 'discordnv' package (version 0.8.0) includes malicious functionality triggered on import. The __init__.py calls main_entry(), which hides the console window and scans local LevelDB and SQLite stores for Discord tokens, decrypts Roblox cookies from 'robloxcookies.dat' using DPAPI, and sends the stolen data to a Discord webhook and a Google Apps Script URL. It also adds a registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run named 'discordnv' to ensure execution on user login. All operations suppress errors to avoid user detection. The package's stated purpose as a Roblox DataStore helper is a decoy.

This malicious package compromises user security by stealing sensitive authentication tokens for Discord and Roblox, enabling unauthorized access to user accounts. The persistence mechanism ensures continued data theft on each login. The exfiltration to external endpoints poses a significant privacy and security risk to affected users. There is no indication of active exploitation in the wild beyond the package's presence.

Users should immediately uninstall the 'discordnv' package version 0.8.0 and remove any related startup registry entries to prevent re-execution. Avoid installing packages from untrusted sources or with unclear provenance. Since no patch or official fix is available, removal and system cleanup are the primary mitigations.