Threat Actors Exploit Discord Webhooks for C2 via npm, PyPI, and Ruby Packages

Threat actors are increasingly abusing Discord webhooks as covert command-and-control channels inside open-source packages, enabling stealthy exfiltration of secrets, host telemetry, and developer environment data. According to Socket’s Threat Research Team, abuse is active across npm, PyPI, and RubyGems, where hard-coded Discord webhook URLs act as write-only sinks to siphon data over HTTPS to attacker-controlled channels.

The write-only nature of webhook URLs, which do not allow reading channel history, helps attackers evade retrospective investigation and lowers friction, with typical HTTPS responses confirming or denying access.

In npm, packages such as mysql-dumpdiscord target configuration files and post data to a Discord webhook, while nodejs[.]discord forwards arbitrary strings to an embedded webhook URL; PyPI packages like malinssx trigger a post during pip install, with the same actor handle sdadasda232323 reusing multiple package names. On RubyGems, sqlcommenter_rails collects host-level signals and ships payloads to a hard-coded webhook, a pattern suggesting cross-ecosystem persistence.

Mitigations focus on behavioural and egress controls, treating webhook endpoints as exfiltration vectors and enforcing allow-lists with DNS and TLS SNI filtering where feasible.