Threat Actors Exploit Discord Webhooks for C2 via npm, PyPI, and Ruby Packages

Threat actors are increasingly exploiting Discord webhooks as covert command-and-control (C2) channels within open-source packages. This method allows for the stealthy exfiltration of secrets, host telemetry, and developer environment data without requiring bespoke infrastructure.

Socket's Threat Research Team has identified active abuse across npm, PyPI, and RubyGems . Here, hard-coded Discord webhook URLs function as write-only sinks, transmitting data over HTTPS to attacker-controlled channels. Since webhook posts resemble ordinary JSON traffic to a commonly allowed domain, they often bypass perimeter filtering and signature-based controls.

How Discord Webhooks Function as Exfiltration Pipes

Discord webhooks are HTTPS endpoints that require only a URL containing an ID and secret token for posting messages to a channel. Live endpoints generally return a 204 No Content on success or a 200 OK with ?wait=true, while responses like 401, 404, and 429 indicate invalid tokens, deletion, or rate limits, respectively. Webhook URLs are write-only, making it difficult for defenders to read prior channel history, complicating takedown and retrospective investigation, while reducing attacker friction and cost.

Write-only access : Webhook URLs only permit message posting, not reading channel history. Minimal authentication : Requires only a URL containing an ID and secret token. Standard HTTP responses : Live endpoints return predictable status codes for validation. Stealth advantage : Traffic appears as legitimate JSON posts to a popular Discord domain.

In npm, the package mysql-dumpdiscord targets sensitive configuration artifacts such as config.json, .env, ayarlar.js, and ayarlar.json (Turkish for "settings"). It reads and chunks file contents before POSTing them to a hard-coded Discord webhook. Similarly, nodejs.discord implements a thin wrapper around discord.js that forwards arbitrary strings to an embedded webhook URL, which can be used as a data sink if invoked during install scripts or runtime.

On PyPI , the package malinssx overrides setuptools' install command to silently trigger a POST to a Discord webhook during pip install, sending a notification message in Vietnamese. Identical packages (malicus, maliinn) have been published by the same actor using the handle sdadasda232323, reusing the same webhook, indicating automated or iterative seeding to evade single-package takedowns.

npm targeting : Configuration files like .env, config.json, and Turkish "ayarlar" settings files. PyPI infiltration : Install-time hooks executed during the pip install process. RubyGems exploitation : Host-level data collection, including /etc/passwd and system metadata. Cross-platform persistence : Threat actors deploying across multiple package ecosystems.

On RubyGems, the package sqlcommenter_rails collects host-level signals, including /etc/passwd contents, DNS resolvers from /etc/resolv.conf, username, hostname, working and home directories, package metadata, and public IP via api.ipify.org. It serializes and ships the full payload to a hard-coded Discord webhook, suppressing errors to favor silent failures over noisy exceptions.

Why This Tactic Works and Mitigation Strategies

Discord webhook C2 offers economic advantages in supply-chain abuse. It is free, fast, and uses TLS traffic to a popular domain, requiring no authentication beyond URL possession. When combined with install-time hooks, postinstall scripts, or Ruby/Python setup overrides, these packages can exfiltrate secrets from developer laptops and CI runners before application runtime controls or EDR detections engage. Similar patterns are observed with Telegram, Slack, and GitHub webhooks, representing a broader shift to "commodity C2 as a service" that reduces the effectiveness of static IOCs.

Economic advantage : Free infrastructure eliminates hosting costs and technical complexity. Evasion tactics : TLS traffic to trusted domains bypasses most security controls. Timing exploitation : Install-time execution occurs before runtime security monitoring. Expanded attack surface : Similar patterns emerging across Telegram, Slack, and GitHub webhooks.

Mitigation strategies should focus on behavioral and egress controls. Treat webhook endpoints as potential exfiltration vectors, enforcing allow-lists with DNS and TLS SNI filtering where feasible. Pin dependencies with lockfiles, require provenance/SLSA attestations, and gate dependency updates through PR scanning that flags hard-coded webhook URLs, outbound network calls, and install-time execution. Scan for secret access in package diffs and rotate developer credentials with least-privilege scopes. In CI, deny outbound internet by default for build and test steps, granting narrowly scoped exceptions. Equip developer workflows with package reputation and malware detection that intercept webhook-based exfiltration patterns before deployment.

ID Technique Name

T1005 Data from Local System

T1016 System Network Configuration Discovery

T1020 Automated Exfiltration

T1033 Account Discovery

T1059 Command and Scripting Interpreter

T1059.006 Command and Scripting Interpreter: Python

T1059.007 Command and Scripting Interpreter: JavaScript

T1071.001 Application Layer Protocol: Web Protocols

T1082 System Information Discovery

T1119 Automated Collection

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

T1552.001 Unsecured Credentials: Credentials In Files

T1567 Exfiltration Over Web Service

Based on reporting by GBHackers.