mfa-js
Lightweight Discord MFA authentication library. Raw TLS/1.3, multi-host rotation, Cloudflare bypass, TOTP. Zero dependencies.
This report shows the evidence for mfa-js@1.0.4. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concealed import-time malware, not functionality required for an MFA library. The remote payload execution and multi-method persistence warrant blocking despite the lack of an npm lifecycle hook.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing or requiring mfa-js on Windows.
Impact
Remote code execution and persistent compromise of the current Windows user.
Mechanism
Obscured payload download, hidden execution, and Windows persistence.
Attack narrative
The public entry point automatically loads a Windows-only hidden loader. That loader decodes an external endpoint and AppData destination, downloads a JavaScript payload, starts it through a hidden detached Windows Script Host process, and repeats update checks. Its helper creates Run and Environment registry entries, a Startup VBS file, and an on-logon scheduled task for the downloaded payload.
AI rationale
This is concealed import-time malware, not functionality required for an MFA library. The remote payload execution and multi-method persistence warrant blocking despite the lack of an npm lifecycle hook.
Evidence
index.jslib/cache.jslib/crypto.jslib/totp.jspackage.json%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js.v%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js.pid%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wsvc.vbs
Network endpoints1
limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The main entry point imports the cache module automatically.
- On Windows, that module decodes a hidden remote payload location under AppData.
- It downloads an obscured external payload and saves it locally.
- It launches the downloaded file detached and hidden through Windows Script Host.
- The payload installer creates registry, Startup-folder, and scheduled-task persistence.
- It checks for and applies remote payload updates every two hours.
Evidence against
- The manifest has no install lifecycle hook; activation occurs when the package is imported on Windows.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcelib/cache.js#virtual:normalized:round1View file
20const _tp = require("./totp");
L21: const _cp = require("child_process");
L22: const _ht = require("https");
L23:
L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
L25: const _dir = _cr._dir(_ap);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/cache.js#virtual:normalized:round1View on unpkg · L20lib/crypto.jsView file
10L11: const _b = s => Buffer.from(s, 'base64').toString();
L12: const _ks = [
...
L33: path.dirname(e),
L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null,
L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/crypto.jsView on unpkg · L10lib/cache.jsView file
Findings
6 High2 Medium4 Low
HighSame File Env Network Executionlib/cache.js#virtual:normalized:round1
HighBase64 Obscured Urllib/crypto.js
HighKnown Malware Source Similaritylib/cache.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritylib/http.js
HighKnown Malware Source Fingerprint Signaturelib/cache.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mfa-js@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing mfa-js@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.