Malicious code in spaysdatarbx (PyPI)

The spaysdatarbx PyPI package masquerades as a Roblox DataStore library but contains malicious code that executes on import. It reads and decrypts Roblox session cookies from the local storage file and exfiltrates them to a hardcoded Discord webhook URL. It enumerates profile directories of multiple browsers and Discord, forcibly terminates Discord to release locked files, decrypts stored Discord authentication tokens using DPAPI, and sends these tokens to the same webhook. The malware establishes persistence by copying itself to %APPDATA%\MySystemUtility\ and adding a registry Run key to relaunch on user login, hiding its console window. The package versions 0.1.3 and 0.1.5 are affected. There is no legitimate DataStore functionality present.

Any user who installs and imports the spaysdatarbx package on a Windows machine risks having their Roblox session cookies and all browser-stored Discord tokens stolen and sent to an attacker-controlled Discord webhook. This compromises the victim's Roblox account and Discord accounts accessible via stored tokens. The malware also establishes persistence to continue stealing data on subsequent logins. This leads to account takeover and potential further abuse of compromised accounts.

Users should immediately uninstall the spaysdatarbx package and avoid installing packages from untrusted sources. Since no official patch or fix is available, removal of the malicious package and cleanup of persistence mechanisms (the copied files in %APPDATA%\MySystemUtility\ and the registry Run key) is required. Users should also reset their Roblox and Discord credentials and revoke any active sessions or tokens. Monitor for suspicious activity on affected accounts. Avoid importing unknown or suspicious Python packages.