The PyPI package 'discordnv' version 0.8.0 contains malicious code that, upon import, executes a function which hides the console window and stealthily harvests Discord authentication tokens and Roblox cookies from the victim's machine. It exfiltrates these credentials to a hardcoded Discord webhook and a Google Apps Script endpoint. The package also establishes persistence by adding itself to the Windows startup registry key to run on every user login. Its advertised functionality as a Roblox DataStore helper is a facade unrelated to its actual malicious behavior.