Malicious Code Detected in flycord Package: User Data Exfiltration Risk
Summary
MAL-2026-1049: Malicious code in flycord (PyPI). Affects flycord versions 1.2.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The flycord package, available on PyPI, is designed for users to interact with Discord's API. It offers functionalities that allow developers to create bots and automate tasks within Discord. However, recent findings have revealed that this package contains malicious code that compromises user data, specifically by exfiltrating sensitive information without user consent.
Vulnerability Detail
The vulnerability originates from a malicious implementation within the flycord package, specifically in version 1.2.4. This code silently collects and sends basic user information, such as usernames and IP addresses, to a hardcoded, obfuscated URL. The lack of an opt-out option and the hidden nature of this data collection classify it as a severe privacy violation rather than benign telemetry. The obfuscation of the URL further complicates the identification of the data exfiltration endpoint, posing a significant risk to users' privacy and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall flycordIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the flycord package until a secure version is released. Additionally, consider using alternative libraries that provide similar functionalities without the associated risks.
Conclusion
The flycord package has been identified as containing malicious code that exfiltrates user data without consent. Users are urged to update the package to the latest version or seek alternatives until a secure version is available. Awareness and proactive measures are essential to protect user privacy.
See every vulnerability recorded for flycord →
FAQ
Flycord is a Python package that allows developers to interact with Discord's API for creating bots and automating tasks.
The malicious code in flycord collects basic user information such as usernames and IP addresses.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Currently, the best prevention is to avoid using the flycord package until a secure version is released.
If you have used the flycord package, it is advisable to update to the latest version immediately and monitor your system for any unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for flycord.
