npm, PyPI, and RubyGems Packages Found Sending Developer Data to Discord Channels

Summary

Punchy author note: This is urgent if you build, run or vet open-source packages — malicious libraries are exfiltrating developer secrets to Discord channels via webhooks. Socket researchers uncovered multiple npm, PyPI and RubyGems packages that use Discord webhooks as a free, stealthy command-and-control (C2) mechanism to siphon sensitive files and host data during install or at runtime.

The findings highlight specific packages and behaviours: some packages grab .env and config files, others harvest host files like /etc/passwd, and several PyPI packages trigger HTTP requests to Discord on installation. Attackers favour Discord webhooks because they are write-only and cheap to operate, letting threat actors avoid running their own infrastructure and blending exfiltration into normal network traffic.

Key Points

Researchers from Socket identified malicious packages across npm, PyPI and RubyGems that send developer data to attacker-controlled Discord webhooks.
Examples include npm’s mysql-dumpdiscord (steals config.json, .env, ayarlar.js/ayarlar.json) and nodejs.discord (logs to webhook), PyPI packages malinssx/malicus/maliinn (install-time C2 calls), and RubyGems’ sqlcommenter_rails (reads /etc/passwd and /etc/resolv.conf).
Discord webhooks are attractive for exfiltration because they allow write-only posting to channels without authentication — defenders can’t query a webhook to read prior messages.
Malicious packages with install-time hooks or build scripts can exfiltrate secrets from developer machines and CI runners before runtime monitoring kicks in.
The disclosure coincides with Socket flagging 338 malicious npm packages used by North Korean operators (Contagious Interview campaign) that delivered stealer and loader families like HexEval, XORIndex and BeaverTail; many were typosquats or lookalikes and were downloaded tens of thousands of times.
Targets include Web3/crypto developers and job-seeking developers lured via fake opportunities and booby-trapped coding tasks that reference malicious packages.
Removing malicious packages from registries is insufficient if publisher accounts remain active; the campaign is described as a factory-style, state-directed operation with durable resources.

Content Summary

Socket’s analysis shows attackers embedding Discord webhook URLs in open-source packages to receive stolen files and host details. Because webhooks are simple HTTP endpoints that write into Discord channels, they let adversaries receive data without maintaining servers, reducing cost and complexity.

Specific package behaviours range from simple logging to outright theft of credentials and system files. Some PyPI packages execute HTTP callbacks at install-time (pip install triggers exfiltration), while RubyGems and npm examples were found harvesting sensitive files from developer environments and CI. The report also ties this technique into a broader supply-chain campaign from DPRK-linked actors who used hundreds of fake npm packages and aliases to push malware to developers, particularly in crypto and Web3 communities.

Context and Relevance

Why this matters: using developer-facing package registries as an initial access and exfiltration vector flips traditional defensive assumptions. Organisations that rely on third-party packages — especially those that run CI pipelines or accept code from external contributors — are at real risk of secrets leaking before any runtime protections can detect malicious activity.

This story ties into wider trends: increased nation-state use of supply-chain attacks, widespread typosquatting on package registries, and creative use of benign platforms (Discord) as C2. It underlines the need for stricter dependency vetting, secrets management, and install-time controls in CI.

Why should I read this?

Quick and blunt: if you use third-party packages or run CI, this is a must-see. It shows how simple webhooks — stuff teams use for notifications — are being weaponised to steal your keys and config files. Read it so you can check your deps, lock down CI, and stop giving attackers free channels to collect secrets.

Source

Source: https://thehackernews.com/2025/10/npm-pypi-and-rubygems-packages-found.html