MAL-2026-15552

    Dashboard / Malicious Package / MAL-2026-15552

    MAL-2026-15552

    Published: 29 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in discord-mfa (npm)

    Details: Source: amazon-inspector (cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760) On require('discord-mfa'), index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js and executes it via node.exe launched through a hidden wscript.exe/VBS shim. lib/totp.js then installs four independent persistence mechanisms so the fetched payload re-executes on every logon: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost registry value, an HKCU\Environment\UserInitMprLogonScript entry, a hidden/system-flagged wsvc.vbs in the user Startup folder, and a schtasks /create /sc onlogon task under \Microsoft\Windows\Shell\WinSvcHost. Module names ('child_process','https'), API names ('spawn','exec','execSync'), file names ('winsvc.js','node.exe','wsvc.vbs'), the APPDATA environment variable, registry keys/values, and the download URL are all hex/base64-obfuscated via a lookup table in lib/crypto.js. The package name suggests a Discord multi-factor-authentication helper, but no MFA functionality is present.

    References: https://www.npmjs.com/package/discord-mfa/v/3.0.1, https://www.npmjs.com/package/discord-mfa/v/3.0.0

    Affected packages

    Package

    Name: discord-mfa

    Purl: pkg:npm/discord-mfa

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.1
    3.0.0
    MAL-2026-15552 | CVE-DB