OpenSSF/OSV advisory MAL-2026-12797 confirms this npm version as malicious. The package's default export accepts (token, password) arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '🔑 Token' and '🔒 Şifre', to a hardcoded discord.com webhook URL. The destination is non-configurable, and any consumer that imports multi-reqs and invokes the default function forwards those credentials to an author-controlled Discord channel...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in multi-reqs (npm)
Details
The package's default export accepts (token, password) arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '🔑 Token' and '🔒 Şifre', to a hardcoded discord.com webhook URL. The destination is non-configurable, and any consumer that imports multi-reqs and invokes the default function forwards those credentials to an author-controlled Discord channel. Parameter naming and the Turkish 'Hesap Yönetim Sistemi' (Account Management System) framing indicate the module is designed to be consumed or bundled into other code as a credential-harvesting shim.
Decision reason
OpenSSF Malicious Packages via OSV confirms multi-reqs@1.0.1 as malicious (MAL-2026-12797): Malicious code in multi-reqs (npm)