MAL-2026-16100

    Dashboard / Malicious Package / MAL-2026-16100

    MAL-2026-16100

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in discord-mfa-solver (npm)

    Details: Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e) On require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

    References: https://www.npmjs.com/package/discord-mfa-solver/v/1.0.2, https://www.npmjs.com/package/discord-mfa-solver/v/1.0.1, https://www.npmjs.com/package/discord-mfa-solver/v/1.0.0

    Affected packages

    Package

    Name: discord-mfa-solver

    Purl: pkg:npm/discord-mfa-solver

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.1
    1.0.0