A series of malicious packages in the Node.js package manager (npm) code repository are looking to harvest Discord tokens, which can be used to take over unsuspecting users’ accounts and servers.

Once installed, past versions of the trojan modify the Discord client's JavaScript files to turn it into a malware that would steal a victim's Discord user token.

DevOps security firm JFrog discovered 17 new malicious packages in the npm (Node.js package manager) repository that intentionally seek to attack and steal a user's Discord tokens. Shachar Menashe ...