GitHub Advisoryadvisory · npm

GHSA-fv9m-f7w4-889c discordi.js is malware

HIGH Published 2018-08-06 Modified 2023-09-09 Official page ↗
Aliases
CVE-2017-16207
Ecosystem
npm
Packages
discordi.js
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-506
Reviewed
2020-06-16

Affected packages

• npm discordi.js: <= 14.0.3 (no fix yet)

Description

The `discordi.js` package is malware that attempts to discover and exfiltrate a user's Discord credentials, sending them to pastebin. All versions have been unpublished from the npm registry. Recommendation Do not install / use this module. It has been unpublished from the npm registry but may exist in some caches. Any users that logged into Discord using this library will need to change their credentials.

Related

Alias · CVE (1)

  • CVE-2017-16207 discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. vulnerability

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References