osint-tool @0.5
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 4:33 PM UTC
OSV ID
MAL-2024-12320
Ecosystem
pypi
Summary
*osint* packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. The original package suggests being a library for Discord exfiltration, what is suspicious on its own, but in addition, the entry point located in main.py exfiltrate local Discord tokens to a hardcoded webhook. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-discord-token-lib Reasons (based on the campaign): - exfiltration-generic - action-hidden-in-lib-usage
Source: kam193 (10a834a37294b0f3aaf52345444f8c5c2a15dde780c8342446c53ecc05d623c0)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.