discord-mfa

Details

**Severity:** Critical

**Affected versions:** `= 3.0.1`

## Source: amazon-inspector (cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760)
On require('discord-mfa'), index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js and executes it via node.exe launched through a hidden wscript.exe/VBS shim. lib/totp.js then installs four independent persistence mechanisms so the fetched payload re-executes on every logon: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost registry value, an HKCU\Environment\UserInitMprLogonScript entry, a hidden/system-flagged wsvc.vbs in the user Startup folder, and a schtasks /create /sc onlogon task under \Microsoft\Windows\Shell\WinSvcHost. Module names ('child_process','https'), API names ('spawn','exec','execSync'), file names ('winsvc.js','node.exe','wsvc.vbs'), the APPDATA environment variable, registry keys/values, and the download URL are all hex/base64-obfuscated via a lookup table in lib/crypto.js. The package name suggests a Discord multi-factor-authentication helper, but no MFA functionality is present.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/discord-mfa/MAL-2026-15552.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/discord-mfa/MAL-2026-15552.json
- https://www.npmjs.com/package/discord-mfa/v/3.0.0
- https://www.npmjs.com/package/discord-mfa/v/3.0.1
- https://github.com/advisories/GHSA-mv99-5h7r-288m

Compromised versions (1)

• = 3.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.