npm, PyPI, and RubyGems Packages Found Sending Developer Data to Discord Channels

Cybersecurity researchers have uncovered malicious packages across npm, PyPI and RubyGems that use Discord webhooks as a command-and-control channel to exfiltrate data from affected developers’ machines. The findings name npm packages such as mysql-dumpdiscord and nodejs[.]discord, and PyPI packages including malinssx, malicus and maliinn, with RubyGems’ sqlcommenter_rails collecting host information and files like /etc/passwd to a hard-coded Discord webhook.

The report highlights that webhooks are effectively write-only, complicating defenders’ ability to read back posts, a point cited by Socket researcher Olivia Brown according to Socket. The disclosure also notes a broader wave tied to North Korean threat actors described as Contagious Interview, which published more than 338 malicious packages and targeted Web3, cryptocurrency and blockchain developers, as well as job seekers.

Once installed, these packages can siphon credentials, wallet data, keystrokes and screenshots and may download additional payloads such as a Python backdoor codenamed InvisibleFerret. The article emphasises that these supply-chain abuses are fast, inexpensive to operate and can blend with legitimate code and fiat firewall rules, enabling exfiltration even in secure environments.