pypi · Malicious package advisory
Malwaretitan-osint
MAL-2024-11728
Malicious code in titan-osint (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (e8dccaf6be8892f2b8871e634607d1dafc9fbb2b5855156959c454b07ab184aa) *osint* packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. The original package suggests being a library for Discord exfiltration, what is suspicious on its own, but in addition, the entry point located in main.py exfiltrate local Discord tokens to a hardcoded webhook. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-09-discord-token-lib Reasons (based on the campaign): - exfiltration-generic - action-hidden-in-lib-usage
Compromised versions (2)
- 0.1
- 0.2
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.