dcchbotPyPI

The package performs multiple installer-hostile behaviors. (1) dcchbot/init.py auto-invokes run() on import, which triggers interactive input() prompts and an outbound HTTPS GET to a non-PyPI third-party domain (https://evan0708.rf.gd/pypi-backup/json) — any import (including by IDEs, linters, or dependency scanners) blocks on stdin and beacons to attacker-controlled infrastructure. (2) main.py reads data['info']['version'] from that rf.gd endpoint and later uses the value directly inside os.system(f'pip install dcchbot=={latest_version}') in the /bot-update slash handler; a crafted response (e.g. containing shell metacharacters) yields arbitrary command execution on the installer's host. The rf.gd free-subdomain pattern can also be re-registered by third parties if the account lapses, making this a latent RCE channel. (3) main.py hardcodes CODER_ID = 1317800611441283139 and authorizes that Discord user ID inside /op, /stop, /token, and /bot-update handlers in addition to the installer's OWNER_ID — the package author can, on any Discord server where an installer's bot is present, leak the bot token (/token sends bot._token), grant themselves administrator, or trigger the vulnerable update command. This is direct installer-side harm: token exfiltration, privilege escalation on the installer's Discord servers, and remote shell command execution driven by an external URL.