MAL-2026-16100

Dashboard / Malicious Package / MAL-2026-16100

MAL-2026-16100

Summary: Malicious code in discord-mfa-solver (npm)

Details: Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e) On require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer. Source: ghsa-malware (59a6cc9b3233c6e824a129b910428abecf200adf505a9fe251afc688ec4fb66a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/discord-mfa-solver/v/1.0.2, https://www.npmjs.com/package/discord-mfa-solver/v/1.0.1, https://www.npmjs.com/package/discord-mfa-solver/v/1.0.0, https://www.npmjs.com/package/discord-mfa-solver/v/1.0.3, https://github.com/advisories/GHSA-vf4w-775x-ccfh