MAL-2026-17864

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/passwordcracker/MAL-2026-17864.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-17864

Aliases

GHSA-5crh-hjrq-j9p4

Published

2026-10-10T00:14:23Z

Modified

2026-11-03T22:30:04Z

Summary

Malicious code in passwordcracker (npm)

Details

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs try{module['require']('node-net-pool')}catch(_){} to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcracker and passwordcrackv2 with identical code on 2026-10-09 and 2026-10-10.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b3aa1deb3b0d3ec4ce0e4694f806b9887b286764b96f177bc41deec309b9ddc3)

package.json at line 41 declares the sole runtime dependency node-net-pool as an off-registry HTTPS tarball pointing at the main branch of https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz, with no version pin, no commit SHA, and no integrity hash. On npm install, npm fetches whatever that mutable branch currently contains and installs it, running any lifecycle scripts inside the resulting package. The GitHub account hosting the tarball is unrelated to any established publisher, and the shipped source references pool functionality that is not implemented locally, so the external tarball supplies code that this package depends on at runtime. The package also ships an index.js that targets Discord's /api/v9/mfa/finish and vanity-url endpoints with caller-supplied token and password values and disables TLS verification against discord.com, canary.discord.com, and ptb.discord.com — an offensive tool operating on operator-supplied credentials rather than installer-owned data, which does not by itself attack the installer but confirms the package's hostile posture.

Source: ghsa-malware (6c3742d11e065f683645cc957e976b43d7cb67f63a0a99c741a4befdffebae5c)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific

{
    "iocs": {
        "files": [
            {
                "digests": {
                    "sha256": "40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a"
                },
                "note": "Loader stub: silently requires node-net-pool when the package is loaded. Identical in every non-placeholder version.",
                "paths": [
                    "lib/cache.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "note": "Stage two from github.com/lunexindonesia/node-net-pool; Windows-only downloader and persistence installer.",
                "paths": [
                    "node_modules/node-net-pool/index.js"
                ],
                "source": "DROPPED"
            },
            {
                "note": "Stage three downloaded from limbomail.com (first writable directory is used), with winsvc.js.v/.lk/.pid side files, WinSvcHost.vbs launcher and self-deleting WinSvcHostCfg.vbs.",
                "paths": [
                    "%APPDATA%\\Microsoft\\Windows\\WinSxS\\Backup\\winsvc.js",
                    "%APPDATA%\\Microsoft\\Windows\\Themes\\winsvc.js",
                    "%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\winsvc.js",
                    "%TEMP%\\MicrosoftEdge\\winsvc.js"
                ],
                "source": "DROPPED"
            },
            {
                "note": "Startup shortcut; also HKCU Run\\WinSvcHost, RunOnce\\WinSvcHostUpd and HKCU\\Environment\\UserInitMprLogonScript, each running wscript.exe //B //NoLogo WinSvcHost.vbs.",
                "paths": [
                    "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinSvcHost.lnk"
                ],
                "source": "DROPPED"
            },
            {
                "digests": {
                    "sha256": "8e3a8f364d1d5ef4b18b3d67268e11916601b16548cae6bda593da79fcf4fe87"
                },
                "note": "Declares node-net-pool as a dependency fetched from an attacker-controlled GitHub tarball.",
                "paths": [
                    "package.json"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ],
        "urls": [
            "https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y/all.js",
            "https://github.com/lunexindonesia/node-net-pool/archive/refs/heads/main.tar.gz",
            "https://github.com/lunexindonesia/node-net-pool",
            "https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz",
            "https://github.com/trktgq0wbre1/node-net-pool"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021869",
            "import_time": "2026-10-29T13:37:14.044698392Z",
            "modified_time": "2026-10-29T13:18:40Z",
            "sha256": "18e362286afa4b97438643dca95683272a94c022b2d304c3554faf20663c4afb",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-021870",
            "import_time": "2026-10-29T13:37:14.106821231Z",
            "modified_time": "2026-10-29T13:18:49Z",
            "sha256": "b3aa1deb3b0d3ec4ce0e4694f806b9887b286764b96f177bc41deec309b9ddc3",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "GHSA-5crh-hjrq-j9p4",
            "import_time": "2026-11-03T22:17:46.336005468Z",
            "modified_time": "2026-11-03T22:10:37Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "6c3742d11e065f683645cc957e976b43d7cb67f63a0a99c741a4befdffebae5c",
            "source": "ghsa-malware"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- InvisiRisk, Inc. - FINDER
- - https://www.invisirisk.com
  - mailto:research@invisirisk.com

Affected packages

npm / passwordcracker

Package

Name: passwordcracker; View open source insights on deps.dev
Purl: pkg:npm/passwordcracker

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.1.1

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "8e3a8f364d1d5ef4b18b3d67268e11916601b16548cae6bda593da79fcf4fe87",
            "tlsh": "8d21be26c9e82c5717d569e0ec298152b6720c030809bc1473ca86ad8f9e0bb22ff19e"
        },
        {
            "path": "lib/cache.js",
            "sha256": "40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a",
            "tlsh": "1f416c5f39c1f0261bf7a57da91f874ab76c990c200cd5a0796943ecba3213c47b7859"
        },
        {
            "path": "index.js",
            "sha256": "0e3494d24c490978c9e5e3d8b13e45fd261b6fac692f852045ff8b4241b3b63f",
            "tlsh": "7a12621121f7203a0367d0ff9bd7d01567345903355ae9b8b78c9684afc361a85b3aee"
        }
    ],
    "package_integrity": [
        {
            "filename": "passwordcracker-1.1.1.tgz",
            "hashes": {
                "sha1": "5572ae446b4814b94853bae763d9c241bd18e5db",
                "sha512_sri": "sha512-PasUptr5NsIDlOy5xSLwpFTuhesZ/GWMd8x+7zGBiVqTWXccF/8H0zo1saZp31ad7T4urjY0zHyzPNVrL7IY0g=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/passwordcracker/MAL-2026-17864.json"