Discord Weaponized as C2 Server Across Popular Open-Source Package Repositories

According to Socket’s Threat Research Team, malicious packages on popular registries are increasingly weaponizing Discord webhooks as command-and-control endpoints, allowing attackers to exfiltrate files and host telemetry while blending into legitimate HTTPS traffic. In examples from npm, a package named mysql-dumpdiscord uses an index.js script to read common configuration files and post their contents to a hard-coded Discord webhook URL, effectively creating a simple file-exfiltration dropper.

Another npm package, nodejs[.]discord, contains a DiscordWebhook class that sends concatenated messages to a webhook URL, while a PyPI package named malinssx triggers an install-time webhook notification, revealing telemetry on every pip install. A malicious Ruby gem, sqlcommenter_rails, collects host information and posts it to a Discord webhook over HTTPS, with network issues quietly ignored to maintain stealth.

The article also outlines defensive measures such as egress filtering, provenance frameworks like SLSA, and runtime monitoring to block or detect these webhook-based C2 attempts.