discord-players

GHSA-qgp7-rhmr-pjmc

Malicious code in discord-players (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.4.2`

## Source: amazon-inspector (3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2)
index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd() (excluding node_modules,.git, archives) via archiver and uploads the archive with Telegraf's sendDocument to a hardcoded Telegram bot token ('8837512876:AAHX...') and chat_id '7549282259' shipped in src/config.js. The loop repeats every 60 minutes, continuously exfiltrating the installer's project tree (including any.env files, credentials, and source code) to the attacker's Telegram chat. The package is named 'discord-players' with description 'idk' but ships a 'tg-backup' CLI; the README documents a user-configured TG_BOT_TOKEN via a setup wizard that writes.env, and bin/setup.js does write a.env, but config.js ignores process.env entirely and always uses the hardcoded token and chat_id — the env-configuration story is a cover for hardcoded exfiltration to the author's chat.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/discord-players/MAL-2026-16213.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/discord-players/MAL-2026-16213.json
- https://www.npmjs.com/package/discord-players/v/3.4.2
- https://github.com/advisories/GHSA-qgp7-rhmr-pjmc

Compromised versions (1)

= 3.4.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.