The 'happy-dlscord.js' npm package is a malicious typosquatting variant of the popular 'discord.js' library. It contains injected code in src/client/Client.js that triggers upon the client emitting the 'ready' event during login. This code sends the Discord bot token and metadata to a hardcoded attacker-controlled Discord webhook URL. This exfiltration occurs silently and compromises the bot's security, enabling full control over the bot account. The package is designed to deceive developers by closely resembling the legitimate library but includes a payload that steals credentials. The affected version is =14.16.3. Due to the nature of the compromise, any system running this package should be considered fully compromised.

Any developer who installs and uses 'happy-dlscord.js' version 14.16.3 and calls client.login(token) will have their Discord bot token exfiltrated to an attacker. This results in full compromise of the Discord bot, including the ability for the attacker to read all guild messages, send messages as the bot, modify the bot's account, and maintain persistence beyond uninstalling the package. Additionally, the system running this package may be fully compromised, risking exposure of all secrets and keys stored on that computer.

Remove the 'happy-dlscord.js' package immediately. Rotate all Discord bot tokens and any other secrets or keys stored on the affected system from a different, trusted computer. Because the package may have granted full control to an attacker, assume the system is compromised and perform a thorough security assessment and remediation. Avoid installing packages with names that are typosquatting popular libraries. Use official package sources and verify package integrity before installation.