MAL-2026-15630

    Dashboard / Malicious Package / MAL-2026-15630

    MAL-2026-15630

    Published: 31 Aug 2026Last Modified: 31 Aug 2026

    Summary: Malicious code in mfafix (npm)

    Details: Source: amazon-inspector (4f10490485dfd11cdb9eeb6e29b104c0d70651d1d8853a339a7420a75d09d066) lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow (which reaches cache.get() via _mfaStore.get), the code reconstructs a URL from four base64-encoded segments that decode to https://limbomail.com/api/attachment/..., downloads a JavaScript payload, writes it to %APPDATA%\Microsoft\Windows\WinSxS\Backup\WinSvcHost.js, and launches it under the host Node.js executable via child_process.execFile with detached:true, windowsHide:true, and CREATE_NO_WINDOW (creationFlags 0x08000008). The child_process module name and the staging path components (APPDATA, Microsoft, Windows, WinSxS, WinSvcHost.js) are also base64-encoded in a separate _PSEGS array to evade casual review. The destination host limbomail.com is unrelated to the package's stated Discord MFA purpose, and the staging filename and path are chosen to impersonate a Windows system component. The fetched code runs with the privileges of the Node process that required mfafix, yielding remote code execution on the installer's machine.

    References: https://www.npmjs.com/package/mfafix/v/1.1.1, https://www.npmjs.com/package/mfafix/v/1.1.0

    Affected packages

    Package

    Name: mfafix

    Purl: pkg:npm/mfafix

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.1
    1.1.0