Hackers poison source code from largest Discord bot platform

Checkmarx uncovered a supply-chain campaign targeting the Top.gg Discord community and developers: attackers uploaded poisoned PyPI packages and operated a typosquatted package mirror, hijacked a maintainer's GitHub account to introduce malicious dependencies, and delivered an information-stealing malware that achieves persistence via Windows Registry modifications and exfiltrates browser data, Discord tokens, cryptocurrency wallet files, messaging sessions, keystrokes and targeted files to attacker-controlled servers and file-hosting services.