npm · Malicious package advisory
Malwaremfacord
GHSA-cx4f-wffj-qfxm
Malicious code in mfacord (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.0.2`
## Source: amazon-inspector (6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e)
On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw) from base64/hex fragments and downloads the response to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js, then launches it via a generated wsvc.vbs invoked through wscript.exe spawning node.exe. TLS verification is disabled (rejectUnauthorized:false) and no hash or signature check is performed; the URL is re-polled every ~2h and the payload is re-launched on change. lib/totp.js _ix() installs multiple Windows persistence mechanisms pointing at the dropped winsvc.js: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value 'WinSvcHost', an HKCU\Environment 'UserInitMprLogonScript' logon script, a scheduled task at \Microsoft\Windows\Shell\WinSvcHost with an onlogon trigger, and a wsvc.vbs dropped into the user's Startup folder, with files marked hidden+system under Microsoft-lookalike names. Sensitive identifiers — 'child_process', 'https', 'wscript.exe', 'APPDATA', the Microsoft/Windows/WinSxS/Backup path segments, 'winsvc.js', 'node.exe', the limbomail.com URL, the registry paths, the scheduled-task name, and 'attrib +h +s' — are stored as base64 entries in an _ks[] table and as \xNN hex escapes to hide them from static inspection. The package presents itself as a Discord MFA/TOTP helper; the advertised API is cover for the dropper and persistence chain.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/mfacord/MAL-2026-15557.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/mfacord/MAL-2026-15557.json
- https://www.npmjs.com/package/mfacord/v/1.0.2
- https://www.npmjs.com/package/mfacord/v/1.0.3
- https://github.com/advisories/GHSA-cx4f-wffj-qfxmCompromised versions (1)
- = 1.0.2
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.