CVE-2017-16207: Exfiltration of Discord login tokens in discordi.js
Summary
CVE-2017-16207: discordi.js is malware. Affects discordi.js versions < 14.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
discordi.js is an npm package used for interacting with the Discord API. It provides functionality for creating Discord bots and integrating Discord features into applications. However, a vulnerability has been discovered in versions 0 to 14.0.3 of discordi.js that allows the exfiltration of Discord login tokens to pastebin. This malicious behavior puts user credentials at risk.
Vulnerability Detail
The discordi.js package contains malware that attempts to discover and exfiltrate a user's Discord credentials. It achieves this by sending the login tokens to pastebin. This vulnerability poses a significant threat to users as it can lead to unauthorized access to their Discord accounts. All affected versions of discordi.js have been unpublished from the npm registry, but it may still exist in some caches. Users who have logged into Discord using this library are advised to change their credentials immediately.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to follow the recommended steps to fix the issue and mitigate any potential risks.
Conclusion
The discordi.js package has been found to contain malware that exfiltrates Discord login tokens. This vulnerability poses a significant risk to users' Discord accounts. It is essential to avoid using this package and remove any cached versions. Changing Discord credentials is strongly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for discordi.js →
FAQ
discordi.js is an npm package used for interacting with the Discord API. It provides functionality for creating Discord bots and integrating Discord features into applications.
The vulnerability in discordi.js allows the exfiltration of Discord login tokens, putting user credentials at risk. This can lead to unauthorized access to Discord accounts.
To fix this vulnerability, do not install or use the discordi.js package. Remove any cached versions from your system. Change your Discord credentials if you have used this library.
Yes, all versions of discordi.js from 0 to 14.0.3 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to follow the recommended steps to fix the issue.
Related vulnerabilities
Recent vulnerabilities recorded for discordi.js.
