MAL-2024-11728 Malicious code in titan-osint (PyPI)
- Package
- titan-osint
- Registry
- PyPI
What is MAL-2024-11728?
MAL-2024-11728 is a malicious package in titan-osint, published on 2 Oct 2024.
Official description
osint packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user.
The original package suggests being a library for Discord exfiltration, what is suspicious on its own, but in addition, the entry point located in main.py exfiltrate local Discord tokens to a hardcoded webhook.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2024-09-discord-token-lib
Reasons (based on the campaign):
exfiltration-generic
action-hidden-in-lib-usage
What should I do about MAL-2024-11728?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.