pypi
Malicious questpro @4.0.0
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 12:32 PM UTC
OSV ID
MAL-2026-936
Ecosystem
pypi
Summary
When using the package, user's Discord tokens are silently exfiltrated. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-questpro Reasons (based on the campaign): - infostealer - exfiltration-credentials - action-hidden-in-lib-usage
Source: kam193 (be333f6f44c50eba4d7a7c11754e048bdc2ed092ae58cee1e88cb24225d4d151)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.