Malicious Code Detected in carcent Package: Exfiltration of Discord Credentials
Summary
MAL-2026-808: Malicious code in carcent (PyPI). Affects carcent versions 2.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The carcent package, available on PyPI, is designed for various functionalities within Python applications. However, it has been identified as a malicious package that collects and exfiltrates sensitive Discord credentials from multiple sources, including environment variables and browser data. This vulnerability poses a significant risk to users who have installed this package, as it can lead to unauthorized access to their Discord accounts and other sensitive information.
Vulnerability Detail
The vulnerability originates from the malicious intent of the package's creator, identified as kam193. The carcent package is part of a campaign named '2025-06-soupclaw,' which focuses on exfiltrating user credentials and sensitive data. The package has been confirmed to collect data from various sources, including environment variables and browser data, making it a serious threat to user privacy and security. Users who have installed version 2.1.0 of this package are particularly at risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall carcentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should consider using alternative packages that provide similar functionalities without the associated risks. Additionally, users can enhance their security by regularly updating their Discord credentials and monitoring their accounts for suspicious activity.
Conclusion
The carcent package poses a significant security risk due to its malicious intent to exfiltrate sensitive user data, particularly Discord credentials. Users are strongly advised to uninstall the package and monitor their accounts for any unauthorized access. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities in the future.
See every vulnerability recorded for carcent →
FAQ
The carcent package is a Python library available on PyPI, but it has been identified as malicious and is known to exfiltrate sensitive user data.
The vulnerability allows the malicious package to collect and exfiltrate your Discord credentials, potentially leading to unauthorized access to your account.
You should uninstall the carcent package immediately using 'pip uninstall carcent' and monitor your accounts for any suspicious activity.
Yes, consider using other reputable packages that provide similar functionalities without the risk of data exfiltration.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
