registry / Persistence / mfacord
mfacord
Lightweight Discord MFA authentication library. Raw TLS/1.3, multi-host rotation, Cloudflare bypass, TOTP. Zero dependencies.
This report shows the evidence for mfacord@1.0.2. 4 of 4 known versions are blocked or flagged. The newest version, 1.0.4, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete import-time malware, not a user-invoked library feature. It downloads remote code, executes it hidden, and establishes persistence.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing or requiring mfacord on Windows.
Impact
Arbitrary remote code can run persistently as the current Windows user.
Mechanism
Obscured remote payload download, hidden execution, and Windows persistence.
Attack narrative
The package loads lib/cache.js as an import side effect. On Windows, that code decodes a third-party URL, downloads a script into an AppData path, launches it hidden through wscript, periodically refreshes it, and calls hidden helpers that create registry, Startup-folder, and scheduled-task persistence. This behavior is unrelated to an MFA library and enables the remote operator to replace and run arbitrary code.
AI rationale
This is concrete import-time malware, not a user-invoked library feature. It downloads remote code, executes it hidden, and establishes persistence.
Evidence
index.jslib/cache.jslib/crypto.jslib/totp.jspackage.json%APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wsvc.vbs
Network endpoints1
limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the main entry point immediately loads the hidden cache payload.
- On Windows, the payload downloads an obscured remote executable, saves it under AppData, and launches it hidden.
- The payload establishes registry, Startup-folder, and scheduled-task persistence.
- The remote download URL and destination filename are Base64-obscured.
Evidence against
- package.json contains no npm lifecycle hooks.
- The visible MFA API sends user-supplied credentials only to Discord hosts, but it does not prevent the separate import-time payload.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcelib/cache.js#virtual:normalized:round1View file
20const _tp = require("./totp");
L21: const _cp = require("child_process");
L22: const _ht = require("https");
L23:
L24: const _ap = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
L25: const _dir = _cr._dir(_ap);
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
lib/cache.js#virtual:normalized:round1View on unpkg · L20lib/crypto.jsView file
10L11: const _b = s => Buffer.from(s, 'base64').toString();
L12: const _ks = [
...
L33: path.dirname(e),
L34: process.env.ProgramFiles ? path.join(process.env.ProgramFiles, 'nodejs') : null,
L35: process.env['ProgramFiles(x86)'] ? path.join(process.env['ProgramFiles(x86)'], 'nodejs') : null,
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/crypto.jsView on unpkg · L10lib/cache.jsView file
Findings
6 High2 Medium4 Low
HighSame File Env Network Executionlib/cache.js#virtual:normalized:round1
HighBase64 Obscured Urllib/crypto.js
HighKnown Malware Source Similaritylib/cache.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Similaritylib/http.js
HighKnown Malware Source Fingerprint Signaturelib/cache.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mfacord@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing mfacord@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.