MAL-2026-15552

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-mfa/MAL-2026-15552.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15552
Published
2026-08-29T02:12:23Z
Modified
2026-08-29T02:30:11.886607688Z
Summary
Malicious code in discord-mfa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760)

On require('discord-mfa'), index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from https://limbomail.com/api/attachment/rEa6rTkGfT.o7nh0aBVvDQWmOG47NPBQ3pUjduHeiw to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js and executes it via node.exe launched through a hidden wscript.exe/VBS shim. lib/totp.js then installs four independent persistence mechanisms so the fetched payload re-executes on every logon: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost registry value, an HKCU\Environment\UserInitMprLogonScript entry, a hidden/system-flagged wsvc.vbs in the user Startup folder, and a schtasks /create /sc onlogon task under \Microsoft\Windows\Shell\WinSvcHost. Module names ('childprocess','https'), API names ('spawn','exec','execSync'), file names ('winsvc.js','node.exe','wsvc.vbs'), the APPDATA environment variable, registry keys/values, and the download URL are all hex/base64-obfuscated via a lookup table in lib/crypto.js. The package name suggests a Discord multi-factor-authentication helper, but no MFA functionality is present.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019129",
            "import_time": "2026-08-29T02:22:19.893606841Z",
            "modified_time": "2026-08-29T02:12:23Z",
            "versions": [
                "3.0.1"
            ],
            "source": "amazon-inspector",
            "sha256": "cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760"
        },
        {
            "id": "IN-MAL-2026-019133",
            "sha256": "e7104822a8540efb9e4a4c17a5cad7bc2a1639728e6bd51f93fdf9d7cf2a81d1",
            "source": "amazon-inspector",
            "versions": [
                "3.0.0"
            ],
            "import_time": "2026-08-29T02:22:20.350905341Z",
            "modified_time": "2026-08-29T02:13:01Z"
        }
    ]
}
References
Credits

Affected packages

npm / discord-mfa

Package

Name
discord-mfa
View open source insights on deps.dev
Purl
pkg:npm/discord-mfa

Affected ranges

Affected versions

3.*
3.0.0
3.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "discord-mfa-3.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-Ni62PzFD9trnkQgN0HsqzjA6H2xeXrldnmJMjOEa1FzVGQMu7V2Efg+45udCS61SZtcu9+3EP6Cnn0AGfrafXA==",
                "sha1": "8f08bebeafbd0b1ba3ed0d46056649fa6bbf3973"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "ed894e38f515bd03e43a7eccec3917c5317124270d2fd22b536bf23696fc9a0b",
            "path": "lib/cache.js",
            "tlsh": "afb1d04a25f2a03751ab55ff5b4f81097227e4433148f986bf6cf2883fa2128c6a75d8"
        },
        {
            "sha256": "8db6df3b347b9487cd74147360538a2cc10297ea891e5c7f1f0c3b99bede6678",
            "path": "lib/totp.js",
            "tlsh": "eb71fd9438f1e137229e85c3be279cb46167d0b17182f087ab6cb5ce1fda41bc6664d8"
        },
        {
            "sha256": "2f167d3da6655f882f6ba1d8a4ec69728342100a02e35e7aa0fc1a133ec05105",
            "path": "lib/crypto.js",
            "tlsh": "ce3110057cd6b51c458a93f099afcc0a705ac822238a9a30725dda8e7fb5a38823684d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-mfa/MAL-2026-15552.json"