{"id":"CVE-2017-16207","aliases":["EUVD-2018-0398","GHSA-fv9m-f7w4-889c"],"status":"published","title":"discordi.js is malware","description":"discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00738,"percentile":0.54779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-506"],"published":"2018-06-07T02:00:00Z","modified":"2026-06-17T01:08:58Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"discordi.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"14.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"discordi.js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"14.0.3"}]}]}],"products":[{"vendor":"discordi.js_project","product":"discordi.js"},{"vendor":"hackerone","product":"discordi.js node module"}],"references":[{"url":"https://nodesecurity.io/advisories/545","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16207","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fv9m-f7w4-889c","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/545","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16207","description":"discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:21:18.986Z","cwes":["CWE-506"],"updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2018-0398","description":"discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.","status":"published","published":"2018-06-07T02:00:00Z","modified":"2024-09-17T01:21:18Z","updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-fv9m-f7w4-889c","title":"discordi.js is malware","description":"The `discordi.js` package is malware that attempts to discover and exfiltrate a user's [Discord](https://discordapp.com/) credentials, sending them to pastebin.\n\nAll versions have been unpublished from the npm registry.\n\n\n## Recommendation\n\nDo not install / use this module. It has been unpublished from the npm registry but may exist in some caches. Any users that logged into Discord using this library will need to change their credentials.","status":"published","published":"2018-08-06T21:43:03Z","modified":"2023-09-09T00:00:07Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2017-16207","description":"discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.","status":"published","published":"2018-06-07T02:29:06.927Z","modified":"2026-06-17T01:08:58.643Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"GHSA-fv9m-f7w4-889c","title":"discordi.js is malware","description":"The `discordi.js` package is malware that attempts to discover and exfiltrate a user's [Discord](https://discordapp.com/) credentials, sending them to pastebin.\n\nAll versions have been unpublished from the npm registry.\n\n\n## Recommendation\n\nDo not install / use this module. It has been unpublished from the npm registry but may exist in some caches. Any users that logged into Discord using this library will need to change their credentials.","status":"published","published":"2018-08-06T21:43:03Z","modified":"2023-11-08T03:59:11.323049Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-506"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}