Researchers Uncover Malware in Fake Discord PyPI Package Downloaded 11,500+ Times
May 07, 2025
Software Supply Chain / Malware
Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that masquerades as a seemingly harmless Discord-related utility but incorporates a remote access trojan. The package in question is discordpydebug , which was uploaded to PyPI on March 21, 2022. It has been downloaded 11,574 times and continues to be available on the open-source registry. Interestingly, the package has not received any update since then. "At first glance, it appeared to be a simple utility aimed at developers working on Discord bots using the Discord.py library," the Socket Research Team said . "However, the package concealed a fully functional remote access trojan (RAT)." The package, once installed, contacts an external server ("backstabprotection.jamesx123.repl[.]co"), and includes features to read and write arbitrary files based on commands, readfile or writefile, received from the server. The RAT also supports the ability...
