Loading npm security reports…

mfa-js@1.0.4: Malicious npm security report (Block) | LPM Firewall

registry / mfa-js / 1.0.4

mfa-js@1.0.4

Lightweight Discord MFA authentication library. Raw TLS/1.3, multi-host rotation, Cloudflare bypass, TOTP. Zero dependencies.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the package on Windows downloads and runs an obscured remote payload. It then establishes multiple Windows persistence mechanisms and periodically updates the payload.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or requiring mfa-js on Windows.

Impact

Remote code execution and persistent compromise of the current Windows user.

Mechanism

Obscured payload download, hidden execution, and Windows persistence.

Attack narrative

The public entry point automatically loads a Windows-only hidden loader. That loader decodes an external endpoint and AppData destination, downloads a JavaScript payload, starts it through a hidden detached Windows Script Host process, and repeats update checks. Its helper creates Run and Environment registry entries, a Startup VBS file, and an on-logon scheduled task for the downloaded payload.

Rationale

This is concealed import-time malware, not functionality required for an MFA library. The remote payload execution and multi-method persistence warrant blocking despite the lack of an npm lifecycle hook.

Evidence

index.jslib/cache.jslib/crypto.jslib/totp.jspackage.json%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js.v%APPDATA%\Microsoft\Windows\WinSxS\Backup\wnsvc.js.pid%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wsvc.vbs

Source & flagged code

6 flagged · loading source

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

lib/cache.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = lib/cache.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fdab71fb1800a0c1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = mfacord@1.0.2 matchedPath = lib/cache.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/cache.jsView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = index.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = lib/http.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Source & flagged code

6 flagged

lib/cache.js#virtual:normalized:round1View file

20const _tp = require("./totp"); L21: const _cp = require("child_process"); L22: const _ht = require("https"); L23: L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); L25: const _dir = _cr._dir(_ap);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/cache.js#virtual:normalized:round1View on unpkg · L20

lib/crypto.jsView file

10L11: const _b = s => Buffer.from(s, 'base64').toString(); L12: const _ks = [ ... L33: path.dirname(e), L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null, L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/crypto.jsView on unpkg · L10

lib/cache.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = lib/cache.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fdab71fb1800a0c1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = mfacord@1.0.2 matchedPath = lib/cache.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/cache.jsView on unpkg

index.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = index.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfacord@1.0.2 matchedPath = lib/http.js matchedIdentity = npm:bWZhY29yZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg