Malicious NPM project steals browser info and Discord accounts

Security researchers discovered today an npm package that contains malicious code designed to steal sensitive Discord and browser files.

Sonatype researcher Ax Sharma discovered an npm package, dubbed discord.dll, that contains malicious code designed to steal sensitive files from a user’s browsers and Discord application.

The malicious JavaScript library was uploaded to the npm packet repository and has been already removed. The repo is used by developers to include libraries (npm packages) inside their projects.

The discord.dll project has been available on NPM portal for five months and has been downloaded by developers one hundred times.

Sonatype researchers reported that once installed, the malicious discord.dll will run malicious code to search the developer’s computer for certain applications and then retrieve their internal LevelDB databases.

The LevelDB databases are used by multiple applications to store information like browsing histories and access tokens.

The information collected by the malicious code includes:

  • User tokens from Discord, Discord Public Test Build (PTB), and Discord Canary
  • Victim’s public IP address via https://api.ipify.org/?format=json
  • PC username and Discord username
  • Browser information from the LevelDB databases

“The discord.dll is an npm component which conducts sinister activities that are hard to spot upfront. It also uses the legitimate Discord.js npm dependency to potentially distract researchers from its otherwise nefarious activities.” reads the analysis published by Sonatype.

“What makes the package difficult to analyze is that it consists of multiple files, almost all of which are heavily obfuscated and have base64-encoded strings everywhere.”

The expert pointed out that discord.dll is a successor of the fallguys package that was discovered in August. The JavaScript library “fallguys” was containing a malicious code used to steal sensitive files from an infected users’ browser and Discord application.

The malicious code was designed to steal sensitive data from major browsers, including Google Chrome, Brave, Opera, and the Yandex Browser. The expert also noticed that the malicious code was also able to steal sensitive data from the Discord instant messaging app, which is very popular in online gaming communities.

“Deobfuscating and reformatting “app.js” reveals NodeJS code which is a tad easier on the eyes.The code has references to Discord, webhooks, setting and getting cookies, “sending” data, Discord tokens, and web browser files.” continues the analysis.

The Discord.dll is able to read the files and post their content in a Discord channel in the form of a Discord webhook.

According to the researchers, the author of the discord.dll package had also uploaded ten other packages on the npm repository, three of which contained malicious behavior that would download and run three EXE files discord.appac-addon, and wsbd.js.

The presence of malicious npm packages in the official repository is becoming frequent.

Last week, the npm security team has removed a malicious JavaScript library named “twilio-npm” from its repository because contained a code for establishing backdoors on the computers of the programmers. Npm is the largest package repository for any programming language.

In October, NPM staff removed four JavaScript packages from the npm portal because were containing malicious code. Npm is the largest package repository for any programming language.

The four packages, which had a total of one thousand of downloads, are:

This marks the fourth major takedown of a malicious package over the past three months.

In late August, the staff removed a malicious npm (JavaScript) library designed to steal sensitive files from an infected users’ browser and Discord application.

In September, the security team removed four npm (JavaScript) libraries for collecting user details and uploading the stolen data to a public GitHub page.

In October, the npm team removed three packages that were also caught opening reverse shells (backdoors) on developer computers. The three packages were also discovered by Sonatype. Unlike the one discovered over the weekend, these three also worked on Windows systems, and not just UNIX-like systems.

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, discord)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

DORA Compliance Strategy for Business Leaders

In January 2025, European financial and insurance institutions, their business partners and providers, must comply…

2 hours ago

CISA adds Android Pixel, Microsoft Windows, Progress Telerik Report Server bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Android Pixel, Microsoft Windows, Progress Telerik Report…

10 hours ago

City of Cleveland still working to fully restore systems impacted by a cyber attack

Early this week, the City of Cleveland suffered a cyber attack that impacted multiple services.…

15 hours ago

Two Ukrainians accused of spreading Russian propaganda and hack soldiers’ phones

Ukraine’s security service (SBU) detained two individuals accused of supporting Russian intelligence in spreading propaganda…

15 hours ago

Google fixed an actively exploited zero-day in the Pixel Firmware

Google is warning of a security vulnerability impacting its Pixel Firmware that has been actively…

1 day ago

Multiple flaws in Fortinet FortiOS fixed

Fortinet released security updates to address multiple vulnerabilities in FortiOS, including a high-severity code execution…

1 day ago

This website uses cookies.