registry / mfasolver / 1.0.0

mfasolver@1.0.0

OSV Malicious Advisory

imported 5h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17663 confirms this npm version as malicious. package.json at line 41 declares the only runtime dependency `node-net-pool` as `https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz` — an off-registry HTTP source pointing at the mutable `main` branch of a GitHub account unrelated to the mfasolver publisher, with no commit pin and no integrity hash...

Advisory

MAL-2026-17663

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mfasolver (npm)

Details

package.json at line 41 declares the only runtime dependency `node-net-pool` as `https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz` — an off-registry HTTP source pointing at the mutable `main` branch of a GitHub account unrelated to the mfasolver publisher, with no commit pin and no integrity hash. `npm install mfasolver` fetches whatever bytes that URL returns at install time and runs any lifecycle scripts contained in the fetched archive. The dependency is additionally force-loaded on require: `lib/cache.js` top-level calls `module['require']('node-net-pool')` inside a try/catch, so importing mfasolver also executes the attacker-controllable code. Separately, `index.js` opens TLS connections to discord.com with `rejectUnauthorized: false`, disabling certificate validation on the package's own Discord traffic.

Decision reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

CryptoFilesystemNetwork

Supply chain

HighEntropyStringsPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 21.5 KB of source, external domains: discord.com

Source & flagged code

2 flagged

package.jsonView file

•Remote tarball dependency specs: node-net-pool@https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

lib/http.jsView file

•matchType = normalized_sha256 matchedPackage = mfa.io@1.0.0 matchedPath = lib/http.js matchedIdentity = npm:bWZhLmlv:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: node-net-pool@https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

lib/http.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/http.jsView on unpkg

Findings

1 High2 Medium4 Low

HighKnown Malware Source Similaritylib/http.js

MediumNetwork

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to mfasolver@1.0.0.

See version security history for other recorded verdicts.

Avoid installing mfasolver@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-08 04:00:04.238Z (UTC).

Source advisory published: 2026-10-08 03:45:15.000Z (UTC).