A malicious Python package targeting Discord developers with remote access trojan (RAT) malware was spotted on the Python Package Index (PyPI) after more than three years.

Named “discordpydebug,” the package was masquerading as an error logger utility for developers working on Discord bots and was downloaded over 11,000 times since it was uploaded on March 21, 2022, even though it has no description or documentation.

Cybersecurity company Socket, which first spotted it, says the malware could be used to backdoor Discord developers’ systems and provide attackers with data theft and remote code execution capabilities.

“The package targeted developers who build or maintain Discord bots, typically indie developers, automation engineers, or small teams who might install such tools without extensive scrutiny,” Socket researchers said.

“Since PyPI doesn’t enforce deep security audits of uploaded packages, attackers often take advantage of this by using misleading descriptions, legitimate-sounding names, or even copying code from popular projects to appear trustworthy.”

Once installed, the malicious package transforms the device into a remote-controlled system that will execute instructions sent from an attacker-controlled command-and-control (C2) server.

The attackers could use the malware to gain unauthorized access to credentials and more (e.g., tokens, keys, and config files), steal data and monitor system activity without being detected, remotely execute code for deploying further malware payloads, and obtain information that can help them move laterally within the network.

​While the malware lacks persistence or privilege escalation mechanisms, it uses outbound HTTP polling instead of inbound connections, making it possible to bypass firewalls and security software, especially in loosely controlled development environments.

Once installed, the package silently connects to an attacker-controlled command-and-control (C2) server (backstabprotection.jamesx123.repl[.]co), sending a POST request with a “name” value to add the infected host to the attackers’ infrastructure.

The malware also includes functions to read from and write to files on the host machine using JSON operations when triggered by specific keywords from the C2 server, giving the threat actors visibility into sensitive data.

To mitigate the risk of installing backdoored malware from online code repositories, software developers should ensure that the packages they download and install come from the official author before installation, especially for popular ones, to avoid typosquatting.

Additionally, when using open-source libraries, they should review the code for suspicious or obfuscated functions and consider using security tools to detect and block malicious packages.

A malicious Python Package Index (PyPI)  package named “set-utils” has been stealing Ethereum private keys through intercepted wallet creation functions and exfiltrating them via the Polygon blockchain.

The package disguises itself as a utility for Python, mimicking the popular “python-utils,” which has over 712 million downloads, and “utils,” which counts over 23.5 million installs.

Researchers from the developer cybersecurity platform Socket discovered the malicious package and reported that set-utils had been downloaded over a thousand times since its submission on PyPI on January 29, 2025.

The open-source supply chain security firm reports that the attacks primarily target blockchain developers utilizing ‘eth-account’ for wallet creation and management, Python-based DeFi projects, Web3 apps with Ethereum support, and personal wallets using Python automation.

As the malicious package is targeting cryptocurrency projects, even though there were only a thousand downloads, it could impact a far larger number of people who used the applications to generate wallets.

Stealthy Ethereum keys theft

The malicious set-utils package embeds the attacker’s RSA public key to be used for encrypting stolen data and an Ethereum sender account controlled by the attacker.

The package hooks into standard Ethereum wallet creation functions like ‘from_key()’ and ‘from_mnewmonic()’ to intercept private keys as they are generated on the compromised machine.

It then encrypts the stolen private key and embeds it in the data field of an Ethereum transaction before it’s sent to the attacker’s account via the Polygon RPC endpoint “rpc-amoy.polygon.technology/.”

Compared to traditional network exfiltration methods, embedding stolen data in Ethereum transactions is far stealthier and more challenging to distinguish from legitimate activity.

Firewalls and antivirus tools typically monitor HTTP requests but not blockchain transactions, so this method is unlikely to raise any flags or get blocked.

Also, Polygon transactions have very low processing fees, no rate limiting applies to small transactions, and offer free public RPC endpoints, so the threat actors do not need to set up their own infrastructure.

Once the exfiltration process is done, the attacker can retrieve the stolen data at any time, as the stolen information is permanently stored on the blockchain.

The set-utils package was removed from PyPI following its discovery. However, users and software developers who incorporated it into their projects should uninstall it immediately and assume that any Ethereum wallets created are compromised.

If the said wallets contain funds, it is recommended to move them to another wallet as soon as possible, as they are at risk of getting stolen at any moment.