Stealth C2: Hackers Abuse Discord Webhooks for Covert Data Exfiltration in npm, PyPI, and RubyGems Supply Chain Attacks

The Socket Threat Research Team has identified a growing trend among malicious package developers to use Discord webhooks as command-and-control endpoints for covert data exfiltration in npm, PyPI and RubyGems supply chains. According to the researchers, attackers are shifting to low-cost, persistent infrastructure by leveraging Discord webhooks, which are HTTPS endpoints that post payloads to a target channel.

The article details several examples, including an npm package called mysql-dumpdiscord that exfiltrates files such as .env and config.json to a hard-coded webhook, and a minimal wrapper in the nodejs[.]discord package that sends input directly to a webhook via WebhookClient. PyPI has seen the malinssx package masquerade as a test library while secretly transmitting installation telemetry to Discord, with RunPayload[.]run() JSON-encoding a post-install message during pip install.

The RubyGems incarnation sqlcommenter_rails harvested host data, including /etc/passwd contents, and exfiltrated it to a Discord webhook, highlighting how a “dependency confusion test” can enable both telemetry and high-volume exfiltration.