registry / mfahelper / 1.0.0

mfahelper@1.0.0

OSV Malicious Advisory

imported 9d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17308 confirms this npm version as malicious. package.json declares its only runtime dependency, `node-net-pool`, as an https tarball pointing at the `main` branch of an unrelated GitHub account (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`) — no version pin, no commit SHA, no integrity hash...

Advisory

MAL-2026-17308

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mfahelper (npm)

Details

package.json declares its only runtime dependency, `node-net-pool`, as an https tarball pointing at the `main` branch of an unrelated GitHub account (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`) — no version pin, no commit SHA, no integrity hash. `npm install` fetches whatever bytes currently live at that mutable URL and executes any lifecycle scripts they contain on the installer's machine. In addition, lib/cache.js runs `module.require('node-net-pool')` inside a swallowed try/catch at top level, so the third-party payload also loads when a consumer `require()`s the package, extending the code-execution surface beyond install time to any downstream import. The account owning the tarball URL is unrelated to the package publisher, so whoever controls that branch controls arbitrary code delivered to every installer.

Decision reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 21.5 KB of source, external domains: discord.com

Source & flagged code

2 flagged

package.jsonView file

•Remote tarball dependency specs: node-net-pool@https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfa.io@1.0.0 matchedPath = lib/http.js matchedIdentity = npm:bWZhLmlv:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: node-net-pool@https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

lib/http.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Findings

1 High2 Medium4 Low

HighKnown Malware Source Similaritylib/http.js

MediumNetwork

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mfahelper@1.0.0.

See version security history for other recorded verdicts.

Avoid installing mfahelper@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 01:45:11.209Z (UTC).

Source advisory published: 2026-09-30 01:00:23.000Z (UTC).