OpenSSF/OSV advisory MAL-2026-15629 confirms this npm version as malicious. package.json declares dependency `node-net-pool` with its value set to an arbitrary HTTPS tarball URL (`https://limbomail.com/api/attachment/fpwvxc__9DvM.Bjuueu1K2SkBC_KkgATls-oq05UsrNNY/pkg.tgz`) rather than a registry version range. On `npm install`, npm fetches whatever bytes limbomail.com returns and installs them, executing any lifecycle scripts inside the fetched tarball...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in mfaatest (npm)
Details
package.json declares dependency `node-net-pool` with its value set to an arbitrary HTTPS tarball URL (`https://limbomail.com/api/attachment/fpwvxc__9DvM.Bjuueu1K2SkBC_KkgATls-oq05UsrNNY/pkg.tgz`) rather than a registry version range. On `npm install`, npm fetches whatever bytes limbomail.com returns and installs them, executing any lifecycle scripts inside the fetched tarball. The source is unpinned, integrity-unchecked, and hosted on a domain unrelated to the package's stated publisher; the content can be swapped at any time by whoever controls that host. The package's own description claims 'zero runtime dependencies', contradicting the presence of this off-registry dependency and matching the smuggled-dropper shape.
Decision reason
OpenSSF Malicious Packages via OSV confirms mfaatest@1.0.0 as malicious (MAL-2026-15629): Malicious code in mfaatest (npm)