Malicious code in spaysrbx (PyPI)

The spaysrbx package (version 0.3.0) on PyPI is a malicious package masquerading as a Roblox DataStore library. Its __init__.py triggers a main_entry() function that performs three attacker-benefit actions: (1) reads and decrypts Roblox cookies from the user's local storage and sends them to a Discord webhook; (2) enumerates multiple browser and Discord profile directories, decrypts stored tokens using Windows DPAPI and AES-GCM, terminates Discord.exe processes, and exfiltrates the tokens and user info to the same webhook; (3) copies itself to %APPDATA%/MySystemUtility/ and sets a registry autorun key to maintain persistence with a hidden console window. No legitimate DataStore functionality exists in the source code.

This malicious package compromises user credentials by stealing Roblox session cookies and Discord tokens, enabling attackers to hijack user accounts and potentially perform unauthorized actions. The persistence mechanism allows the malware to survive reboots and maintain ongoing access to victim machines. The stealthy nature of the attack, including hidden execution and process termination, increases the risk of prolonged undetected compromise.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing or using spaysrbx version 0.3.0. Remove any installations of this package immediately. Investigate and revoke any compromised Roblox and Discord credentials. Monitor for suspicious activity on affected accounts. Employ endpoint security solutions to detect and block similar malicious behaviors.