MAL-2026-11050 Malicious code in discordnv (PyPI)

On import discordnv, init.py invokes main_entry() which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite stores to extract Discord authentication tokens, reads and DPAPI-decrypts Roblox robloxcookies.dat, and POSTs the harvested credentials to a hardcoded Discord webhook at discord.com/api/webhooks/1528403989983662194/… and a Google Apps Script endpoint at script.google.com/macros/s/AKfycbwa…/exec. add_to_startup() writes an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named discordnv pointing at the invoking Python/exe so the stealer re-runs on every user logon. All operations are wrapped in bare try/except to swallow errors and avoid alerting the user. The package's advertised purpose (a Roblox DataStore helper) is unrelated to the observed behavior.

The package exfiltrates Roblox cookies and Discord tokens from the victim machine.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-spaysrbdata

Reasons (based on the campaign):

• infostealer