Critical Malicious Code Vulnerability in noteasonfnsource Package
Summary
MAL-2026-1098: Malicious code in noteasonfnsource (PyPI). Affects noteasonfnsource versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noteasonfnsource package, available on PyPI, is designed to provide functionalities for Discord bot development. It allows users to create bots that can interact with Discord servers, executing commands and automating tasks. However, this package has been compromised, leading to severe security implications for users who integrate it into their applications.
Vulnerability Detail
The vulnerability originates from malicious code embedded in the noteasonfnsource package, specifically in version 1.0.3. Once a generic command is executed, the bot performs harmful actions such as deleting all channels on the Discord server, renaming the server, and creating an endless loop of spam channels while notifying all members. This poses significant risks, including data loss and disruption of server operations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall noteasonfnsourceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can disable the bot or remove it from their Discord server until the vulnerability is addressed. Additionally, ensure that no commands are executed that could trigger the malicious actions.
Conclusion
The noteasonfnsource package has a critical vulnerability due to malicious code that can severely disrupt Discord servers. Users are advised to uninstall the package immediately and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for noteasonfnsource →
FAQ
noteasonfnsource is a Python package designed for creating Discord bots, allowing developers to automate interactions within Discord servers.
The malicious code deletes all channels, renames the server, and creates spam channels while notifying all members, causing chaos within the server.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed noteasonfnsource, you should uninstall it immediately and refrain from executing any commands associated with it.
As of now, there is no patched version available. Users should monitor the package repository for updates and apply them as soon as they are released.
