mfakit

GHSA-r4f7-w4j9-xj27

Malicious code in mfakit (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.4.0`

## Source: amazon-inspector (f11dc9d39df6906a4b784b0cb3a584b5307816d20c4cc04fb28bbb40f59c3fb8)
The package advertises itself as a lightweight Discord MFA library, but require() of its main entry loads lib/cache.js which schedules a setImmediate handler that runs on Windows (guarded by process.env.SystemRoot). The handler XOR-decodes hidden hex constants against a base64 salt to reconstruct a fetch URL (https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw) and OS-command tokens (child_process, spawn, execSync, wscript.exe, node.exe, attrib +h +s). It downloads a script to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js, hides it with attrib +h +s, spawns it detached under node.exe, writes a.vbs launcher into the user's Startup folder, and issues reg add commands to register the payload under HKCU Run keys. A timer re-fetches the payload every ~2 hours. None of this behavior is disclosed in package.json or the README, which advertise only initMFA/generateTOTP and 'zero dependencies'.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/mfakit/MAL-2026-15558.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/mfakit/MAL-2026-15558.json
- https://www.npmjs.com/package/mfakit/v/1.4.0
- https://github.com/advisories/GHSA-r4f7-w4j9-xj27

Compromised versions (1)

= 1.4.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.