MAL-2026-15558

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mfakit/MAL-2026-15558.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15558
Published
2026-08-29T02:08:33Z
Modified
2026-08-29T02:30:12.888662833Z
Summary
Malicious code in mfakit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f11dc9d39df6906a4b784b0cb3a584b5307816d20c4cc04fb28bbb40f59c3fb8)

The package advertises itself as a lightweight Discord MFA library, but require() of its main entry loads lib/cache.js which schedules a setImmediate handler that runs on Windows (guarded by process.env.SystemRoot). The handler XOR-decodes hidden hex constants against a base64 salt to reconstruct a fetch URL (https://limbomail.com/api/attachment/rEa6rTkGfT.o7nh0aBVvDQWmOG47NPBQ3pUjduHeiw) and OS-command tokens (childprocess, spawn, execSync, wscript.exe, node.exe, attrib +h +s). It downloads a script to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js, hides it with attrib +h +s, spawns it detached under node.exe, writes a.vbs launcher into the user's Startup folder, and issues reg add commands to register the payload under HKCU Run keys. A timer re-fetches the payload every ~2 hours. None of this behavior is disclosed in package.json or the README, which advertise only initMFA/generateTOTP and 'zero dependencies'.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019127",
            "modified_time": "2026-08-29T02:08:33Z",
            "import_time": "2026-08-29T02:22:19.683304637Z",
            "source": "amazon-inspector",
            "sha256": "f11dc9d39df6906a4b784b0cb3a584b5307816d20c4cc04fb28bbb40f59c3fb8",
            "versions": [
                "1.4.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mfakit

Package

Name
mfakit
View open source insights on deps.dev
Purl
pkg:npm/mfakit

Affected ranges

Affected versions

1.*
1.4.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "mfakit-1.4.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-aJY3ave1EMj1ZrkOoeD+/Fi3ACnONchj+WeAo2O/IBuGsBEIWGzXQa9VjRsxYdya+60ODXQqcMliVUHB0AASQg==",
                "sha1": "5c054fba03f0516956f0a00fd595e922d9e878cf"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "lib/cache.js",
            "tlsh": "d5d1d84b3ab11224569281ee9a4f813a726ad8513547d5e47b5c01ac3fd363cc6f38ed",
            "sha256": "29a0246e5a9f8b39d72ec1bf7d35ba169388a606aa0802c0aada70ec499934c3"
        },
        {
            "path": "README.md",
            "tlsh": "0a51b91652f7783324a79182fe41bd91de219005930b4482199ee8cdb0cdae9cb7f5cf",
            "sha256": "5022df350572e179be8aa80150d992a11549b79c83c57bd9950442f54b73bd58"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mfakit/MAL-2026-15558.json"