registry / Remote code execution / mfafix
mfafix
Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies.
This report shows the evidence for mfafix@1.1.1. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execution, and deceptive user-directory placement.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer calls initMFA for the first time.
Impact
An attacker-controlled remote script runs as the consuming user's account.
Mechanism
Obfuscated remote payload download followed by detached execution.
Attack narrative
The normal initMFA call reads the internal cache. Its first read decodes a concealed URL and Windows-like destination, downloads the response, writes it to the user profile, and starts it with detached hidden-process options. The downloaded code is not included in the package, so its behavior is attacker-controlled at runtime.
AI rationale
This package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execution, and deceptive user-directory placement.
Evidence
package.jsonindex.jslib/cache.js%APPDATA%/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js
Network endpoints1
limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKb3RalN_TVUZYGPsJy2Y
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Base64 fragments conceal a remote payload URL.
- On first cache read, the package downloads and writes the remote payload.
- It runs the downloaded file as a detached, hidden Node process.
- Calling initMFA reaches the cache read that triggers this chain.
- The decoded destination is a deceptive Windows AppData path.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The Discord API requests are part of the advertised MFA functionality.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
6 flagged · loading sourceindex.jsView file
180function initMFA(config) {
if (!config || !config.TOKEN) throw new Error('TOKEN required');
const token = config.TOKEN;
const password = config.PASSWORD || '';
const guildIds = (config.GUILD_IDS || []).map(String);
const log = config.log || null;
const ttl = config.refreshInterval || 210000;
const xsp_ = _XSP;
const _ck = '_m' + token.substring(0, 10);
const primaryGuild = guildIds[0] || '1';
let mfaToken = _mfaStore.get(_ck) || null;
High
Ai Review Evidence
Calling initMFA reaches the cache read that triggers this chain.
index.jsView on unpkg · L1802L3: const tls = require('tls');
L4: const crypto = require('crypto');
Medium
lib/cache.jsView file
61* (_SEGS) and path-component (_PSEGS) tokens are
L62: * stored as base64 fragments rather than single
L63: * literals so they survive minification and
...
L104: function _pullAsset(url, dest, cb) {
L105: const fs = require('fs'), path = require('path'), https = require('https');
L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {}
...
L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString();
L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2));
L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));
Findings
5 High3 Medium4 Low
HighBase64 Obscured Urllib/cache.js
HighPrevious Version Dangerous Deltalib/cache.js
HighAi Review Evidencelib/cache.js
HighAi Review Evidencelib/cache.js
HighAi Review Evidenceindex.js
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mfafix@1.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing mfafix@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.