discord-mfa-solver

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e)
On require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/780c0d27fc72f2410865c6cc82096cc895eb0a36/osv/malicious/npm/discord-mfa-solver/MAL-2026-16100.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/780c0d27fc72f2410865c6cc82096cc895eb0a36/osv/malicious/npm/discord-mfa-solver/MAL-2026-16100.json
- https://www.npmjs.com/package/discord-mfa-solver/v/1.0.0
- https://www.npmjs.com/package/discord-mfa-solver/v/1.0.1
- https://www.npmjs.com/package/discord-mfa-solver/v/1.0.2
- https://github.com/ossf/malicious-packages/blob/dbf5f37beed5d3b50a3d03bdfcce82da59ec126a/osv/malicious/npm/discord-mfa-solver/MAL-2026-16100.json
- https://www.npmjs.com/package/discord-mfa-solver/v/1.0.3
- https://github.com/advisories/GHSA-f5p4-vw6q-5w28

Compromised versions (1)

• = 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.