A dangerous security threat has emerged on the Python Package Index (PyPI) targeting Discord developers. The malicious package ‘pycord-self’ masquerades as the legitimate ‘discord.py-self’ library, which has amassed over 28 million downloads.

The Threat
The counterfeit package, uploaded in June last year with 885 downloads, mimics the functionality of the official Discord Python library while secretly performing two malicious actions:

1. Token Theft:
– Steals Discord authentication tokens
– Transmits stolen tokens to external servers
– Enables account hijacking, bypassing even two-factor authentication

2. System Backdoor:
– Creates persistent connection to remote server through port 6969
– Launches system shells (bash/cmd) based on operating system
– Operates stealthily in separate thread while maintaining package functionality

Security Recommendations:
– Verify package authenticity and official authorship
– Check for accurate package naming to avoid typosquatting
– Review code for suspicious functions
– Avoid obfuscated code
– Implement package scanning tools

The legitimate discord.py-self library remains a trusted tool for Discord API integration, allowing developers to create bots, automate moderation, and manage notifications programmatically.