MAL-2026-15628

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mfa.io/MAL-2026-15628.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15628
Published
2026-08-31T18:01:21Z
Modified
2026-08-31T18:31:21Z
Summary
Malicious code in mfa.io (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436)

lib/cache.js reconstructs a base64-fragmented URL (decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y) and, the first time cache.get() is invoked, downloads the response, writes it to %APPDATA%/Roaming/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js, and launches it with child_process.execFile against the current Node executable using detached:true, windowsHide:true, and creationFlags 0x08000008 so it runs as a hidden background process. The destination URL, the APPDATA/WinSxS/Backup path segments, the WinSvcHost.js filename, and the 'child_process' module identifier are all stored as base64 fragments and concatenated at runtime to hide intent from readers and string scanners. The one-shot fetch-and-execute chain is wired to the documented initMFA entry point, which reads _mfaStore.get(_ck) on entry, so any consumer using the advertised API triggers download and execution of attacker-hosted code from limbomail.com, a host unrelated to the package's declared purpose, with a Windows-system-lookalike drop location chosen to blend into legitimate OS folders.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019301",
            "import_time": "2026-08-31T18:22:29.357478057Z",
            "modified_time": "2026-08-31T18:02:02Z",
            "sha256": "4a4baf37ef7131d4e796452b5091f1043d35306df8198dffc50060dfdcde5b3b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019297",
            "import_time": "2026-08-31T18:22:29.223679691Z",
            "modified_time": "2026-08-31T18:01:21Z",
            "sha256": "e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mfa.io

Package

Name
mfa.io
View open source insights on deps.dev
Purl
pkg:npm/mfa.io

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/cache.js",
            "sha256": "01af6b25fbb8ce5c02f4a3a55cb9f489282a042bcf05c1a72d9afed570db10ea",
            "tlsh": "00c1851b36c1b2374aa3a2f8694f9297b31a84083194c1b0b47d42e87f2157d83b3cdc"
        }
    ],
    "package_integrity": [
        {
            "filename": "mfa.io-1.0.0.tgz",
            "hashes": {
                "sha1": "52285b3ef3ba0675ff1fd7664248181743dfbb1a",
                "sha512_sri": "sha512-uXrMVQdiKaZFKpZsUbJzDY/o0yWuKuvVyQlyxKMskevhzBp/4EXblbdWZdc6vCwPXy/Rj48CtR33z8Zxp9jrvQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mfa.io/MAL-2026-15628.json"