Discord Weaponized as C2 Server Across Popular Open-Source Package Repositories
Malicious packages on popular registries are exploiting Discord webhooks to exfiltrate sensitive files and host telemetry, bypassing traditional command and control (C2) infrastructure and blending into legitimate HTTPS traffic.
Malicious packages on popular registries are exploiting Discord webhooks to exfiltrate sensitive files and host telemetry, bypassing traditional command and control (C2) infrastructure and blending into legitimate HTTPS traffic.
Discord webhooks are HTTPS URLs that accept POST requests, requiring no credentials beyond possession of the URL. The traffic appears as innocent JSON over port 443. Attackers embed Discord webhook URLs into open-source packages to serve as C2 endpoints. When a package’s installation or runtime code sends a payload to these webhooks, attackers receive files, host details, or custom messages in a Discord channel they control.
npm Package: mysql-dumpdiscord The index.js script targets common configuration files by resolving each filename’s absolute path and reading its content. If a file exists, the script constructs a message and sends it as JSON to a hard-coded Discord webhook URL.
npm Module: nodejs.discord This module contains a DiscordWebhook class that concatenates arguments into a string and sends them to a webhook URL using Discord.js’s WebhookClient.
Discord webhooks are HTTPS URLs that accept POST requests, requiring no credentials beyond possession of the URL.
PyPI Package: malinssx Overrides setuptools’ install command in setup.py. The RunPayload class sends a JSON payload to a Discord webhook, announcing package installation.
Ruby Gem: sqlcommenter_rails Collects host information and sends it to a Discord webhook. Any network issues are quietly ignored, ensuring stealth.
Defenders must treat webhooks as potential data-loss channels. Egress filtering should enforce allow-lists for outbound HTTPS, especially from build servers and developer workstations. Dependency management practices such as lockfiles and provenance frameworks are critical to block malicious packages before installation. Runtime monitoring should flag code invoking network calls in install hooks or build scripts.
Security tools, such as Socket’s GitHub App and CLI, provide checks for hard-coded webhooks and install-time hooks. The Socket Firewall mediates dependency fetches, blocking known malicious packages. By focusing on behavioral detection and supply chain hygiene, organizations can mitigate Discord-based C2 attacks.
Based on reporting by GBHackers.