OSV ID
MAL-2024-12258
Ecosystem
pypi
Summary
Package suggests a code to build bots; however, the code just exfiltrates the token given by the user to the hardcoded Discord webhook. Looking at other activity on the account, it's either research or forgotten WIP/test. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2024-09-old-discself Reasons (based on the campaign): - action-hidden-in-lib-usage -
Source: kam193 (271e2fef9fd10cd1a179df1be1e1f92c837d1ecf3d074451a9b1b6205babe511)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.