registry / Remote code execution / mfa.io
mfa.io
Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies.
This report shows the evidence for mfa.io@1.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.1, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a complete, obscured remote-download-and-execute chain activated by its primary API. The absence of an install hook does not mitigate this concrete runtime remote-code-execution behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer calls initMFA with a token.
Impact
Remote code execution and hidden user-profile persistence.
Mechanism
Obfuscated remote payload download followed by detached execution.
Attack narrative
After initMFA calls the cache getter, the package reconstructs a hidden URL, downloads its response to a disguised JavaScript path under the Windows roaming profile, then executes it with detached, hidden process settings. The remote content is not bundled or verified, so its behavior is attacker-controlled at runtime.
AI rationale
The package contains a complete, obscured remote-download-and-execute chain activated by its primary API. The absence of an install hook does not mitigate this concrete runtime remote-code-execution behavior.
Evidence
index.jslib/cache.jspackage.jsonAppData/Roaming/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js
Network endpoints1
limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKb3RalN_TVUZYGPsJy2Y
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The cache module hides a remote endpoint in Base64 fragments.
- A cache read downloads the remote response into a Windows user-profile path.
- The downloaded file is launched as a detached hidden Node process.
- Calling initMFA performs that cache read, so normal runtime use triggers the payload chain.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The visible MFA requests use Discord hosts and caller-supplied credentials.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourceindex.jsView file
2L3: const tls = require('tls');
L4: const crypto = require('crypto');
Medium
lib/cache.jsView file
61* (_SEGS) and path-component (_PSEGS) tokens are
L62: * stored as base64 fragments rather than single
L63: * literals so they survive minification and
...
L104: function _pullAsset(url, dest, cb) {
L105: const fs = require('fs'), path = require('path'), https = require('https');
L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {}
...
L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString();
L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2));
L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/cache.jsView on unpkg · L61•matchType = normalized_sha256
matchedPackage = mfafix@1.1.1
matchedPath = lib/cache.js
matchedIdentity = npm:bWZhZml4:1.1.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
5 High3 Medium4 Low
HighBase64 Obscured Urllib/cache.js
HighKnown Malware Source Similaritylib/cache.js
HighKnown Malware Source Similaritylib/http.js
HighAi Review Evidencelib/cache.js
HighAi Review Evidencelib/cache.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mfa.io@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing mfa.io@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.