Malicious Package in discord_debug_log
Summary
GHSA-5x8q-gj67-rhf2: Malicious Package in discord_debug_log. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The discord_debug_log package is an npm package used for logging debug information in Discord applications. It is commonly used by developers to troubleshoot and monitor their Discord bots or other applications. However, all versions of this package contain obfuscated malware that uploads Discord user tokens to a remote server.
Vulnerability Detail
The vulnerability in discord_debug_log allows attackers to gain access to Discord user tokens, which can be used to make purchases on behalf of users if they have credit cards linked to their Discord accounts. The malware within the package collects these tokens and sends them to a remote server controlled by the attackers. This can lead to unauthorized transactions and potential financial loss for affected users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The discord_debug_log package contains obfuscated malware that poses a significant risk to Discord users. It is crucial to remove this package from your environment, review account access, and take necessary steps to protect against unauthorized transactions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for discord_debug_log →
FAQ
discord_debug_log is an npm package used for logging debug information in Discord applications.
The malware collects Discord user tokens and uploads them to a remote server controlled by attackers.
If users have credit cards linked to their Discord accounts, attackers can use the stolen tokens to make unauthorized purchases on their behalf.
To fix this vulnerability, remove the discord_debug_log package, review Discord account access, and rotate tokens if possible.
If a credit card was linked to a compromised account, it is advised to contact your credit card company for further assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for discord_debug_log.
