Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @velliajs/discord (npm)

@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All users who installed @velliajs/discord from npm registry
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • @velliajs/discordnpm package presenting as discord.js clone with embedded malicious mechanisms

The npm package @velliajs/discord was published as a malicious clone of discord.js, with deceptive metadata pointing to the legitimate discord.js repository while shipping hostile code.

The package contained two primary attack mechanisms. First, it declared a runtime dependency on sysframe resolved from an unpinned private GitHub repository (git+https://ghp_...@github.com/navaLinh/node-ai.git) using an embedded GitHub Personal Access Token. This allowed the package author to rewrite the repository HEAD at any time to deliver arbitrary code, including lifecycle scripts that would execute during subsequent npm install operations. Second, the Client.login() method invoked an undocumented _verifyAuthorization routine that fetched an allow-list from a remote GitHub repository under a hardcoded PAT, refusing to start the bot unless the bot's username appeared in the author-controlled list—a hidden kill-switch not disclosed in documentation.

Two live GitHub Personal Access Tokens were hardcoded directly in the shipped package code. The package was identified via GitHub's security advisory system (GHSA-5546-mfxg-3v4r) and reported by Amazon Inspector.

Indicators of compromise

Packages
  • @velliajs/discord

Remediation

  • Immediately uninstall @velliajs/discord from all systems
  • Rotate any GitHub Personal Access Tokens that may have been exposed or used by the malicious package
  • Audit npm install logs and node_modules for presence of the `sysframe` dependency or other unexpected packages
  • Use the legitimate discord.js package from the official discordjs organization instead
  • Review bot account activity for unauthorized access or commands executed during the compromise window
  • Implement npm package verification and allowlisting to prevent installation of typosquatted or malicious packages

Sources

  1. GitHub Advisory GHSA-5546-mfxg-3v4r · GitHub Advisory Database

Cite this entry

"Malicious code in @velliajs/discord (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-velliajs-discord-npm-1cs0vc

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in localize-translate (npm)

    The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in mutex-plus (npm)

    The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.

    npmCompromised packageMalicious commit