MAL-2026-16100

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-mfa-solver/MAL-2026-16100.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16100
Aliases
  • GHSA-vf4w-775x-ccfh
Published
2026-09-09T21:10:15Z
Modified
2026-09-28T07:00:08Z
Summary
Malicious code in discord-mfa-solver (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e)

On require of the package, lib/cache.js (reached from index.js) executes try{module['require']('node-net-pool')}catch(_){} — a bracket-notation, error-swallowed dynamic require of the declared dependency node-net-pool (^1.0.0 in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code node-net-pool runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via child_process.execFile, but no such code (no _SEGS, no _pullAsset, no _spawnWorker, no child_process usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed node-net-pool. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises /api/v9/guilds/0/vanity-url and /api/v9/mfa/finish with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

Source: ghsa-malware (59a6cc9b3233c6e824a129b910428abecf200adf505a9fe251afc688ec4fb66a)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019898",
            "import_time":  "2026-09-09T21:14:32.877614419Z",
            "modified_time":  "2026-09-09T21:10:25Z",
            "sha256":  "447fc485deb497c4e8b7310efa4dd48c82c67bdb1b063ef3afa8b183519b191b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-019899",
            "import_time":  "2026-09-09T21:14:32.901127604Z",
            "modified_time":  "2026-09-09T21:10:33Z",
            "sha256":  "a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-019897",
            "import_time":  "2026-09-09T21:14:32.850826094Z",
            "modified_time":  "2026-09-09T21:10:15Z",
            "sha256":  "f225d62852a2181e36cbea8fbe07ea23921cf1ba07e84eb7dd3cef030cd9c6d9",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020022",
            "import_time":  "2026-09-14T16:40:44.457831637Z",
            "modified_time":  "2026-09-14T16:34:27Z",
            "sha256":  "397e64d0ed82bfc13ede94f1c8bd90c12072b12e11657afca16872a92423188a",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.3"
            ]
        },
        {
            "id":  "GHSA-vf4w-775x-ccfh",
            "import_time":  "2026-09-28T06:54:43.475397559Z",
            "modified_time":  "2026-09-28T06:04:40Z",
            "ranges":  [
                {
                    "events":  [
                        {
                            "introduced":  "0"
                        }
                    ],
                    "type":  "SEMVER"
                }
            ],
            "sha256":  "59a6cc9b3233c6e824a129b910428abecf200adf505a9fe251afc688ec4fb66a",
            "source":  "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / discord-mfa-solver

Package

Name
discord-mfa-solver
View open source insights on deps.dev
Purl
pkg:npm/discord-mfa-solver

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "b63137e30dc39ef6b5431a8d846a3a0133467670e8da288bb43a1b6d64d5574d",
            "tlsh":  "49219b36c8e46e6b17c965a0e815a052f73224474c0e7d00339742addf8f0eb32be55e"
        },
        {
            "path":  "index.js",
            "sha256":  "52583b62314f049289a83dfe59ef488e587deea24c45a783a099b953f7631698",
            "tlsh":  "a412621121f7203a0363d0ff9bd7d01567345903355ae9b8b78c9684afc361a85b3aee"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "discord-mfa-solver-1.0.2.tgz",
            "hashes":  {
                "sha1":  "55cda21b75e86d78a457164466a85bee444dbef5",
                "sha512_sri":  "sha512-sTFq7lO+awI+gAByZ9EjSa8cputunQ877e0FB19D3FDD2Dj/SaCiVgj8alx9R668JKLvEUBPdoi7AlQDx58KOA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-mfa-solver/MAL-2026-16100.json"