registry / mfaby / 1.0.0

mfaby@1.0.0

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16101 confirms this npm version as malicious. The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a base64-encoded string (_CDN_BASE) into the URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads the response body, writes it to a file in os.tmpdir(), and executes it via new Worker(tmp)...

Advisory

MAL-2026-16101

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mfaby (npm)

Details

The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a base64-encoded string (_CDN_BASE) into the URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads the response body, writes it to a file in os.tmpdir(), and executes it via new Worker(tmp). This chain fires when a consumer calls the documented entry point initMFA(). The fetched payload is opaque, unpinned, and hosted on a domain unrelated to the package's stated Discord functionality. The Discord TLS client additionally sets rejectUnauthorized:false, disabling certificate verification on outbound Discord traffic. The base64 concealment of the drop URL combined with a README cover-story describing it as a 'runtime patch asset' indicates deliberate hiding of the endpoint.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 22.4 KB of source, external domains: discord.com

Source & flagged code

1 flagged

lib/http.jsView file

1'use strict'; L2: const https = require('https'); L3: const http = require('http'); ... L28: res.on('data', d => ch.push(d)); L29: res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: Buffer.concat(ch).toString() })); L30: }); ... L61: L62: function parseJson(res) { try { return JSON.parse(res.body); } catch { return null; } } L63: function isOk(res) { return res && res.status >= 200 && res.status < 300; }

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/http.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

lib/http.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/http.jsView on unpkg · L1

Findings

1 High1 Medium4 Low

HighBase64 Obscured Urllib/http.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mfaby@1.0.0.

See version security history for other recorded verdicts.

Avoid installing mfaby@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-09 21:30:03.956Z (UTC).

Source advisory published: 2026-09-09 21:10:42.000Z (UTC).