registry / discord-mfa-solver / 1.0.2

discord-mfa-solver@1.0.2

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Importing the package loads an unpinned remote dependency. Calling initMFA transmits supplied Discord credentials with certificate validation disabled and produces reusable MFA authorization tokens.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Import the package, then call initMFA with a Discord token and password.

Impact

A changed dependency or a network interception could execute unreviewed code or expose Discord credentials and MFA tokens.

Mechanism

Remote dependency loading plus insecure credential-bearing TLS requests.

AI rationale

The package has no install hook, but its import-time mutable remote dependency and disabled TLS verification in a credential-handling MFA flow create a concrete unresolved security risk.

Evidence

package.jsonlib/cache.jsindex.js

Network endpoints4

discord.comcanary.discord.comptb.discord.comgithub.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz

OSV advisory

OpenSSF/OSV

On require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

discord-mfa-solver@1.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code