MAL-2026-16101

    Dashboard / Malicious Package / MAL-2026-16101

    MAL-2026-16101

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in mfaby (npm)

    Details: Source: amazon-inspector (c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455) The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a base64-encoded string (_CDN_BASE) into the URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads the response body, writes it to a file in os.tmpdir(), and executes it via new Worker(tmp). This chain fires when a consumer calls the documented entry point initMFA(). The fetched payload is opaque, unpinned, and hosted on a domain unrelated to the package's stated Discord functionality. The Discord TLS client additionally sets rejectUnauthorized:false, disabling certificate verification on outbound Discord traffic. The base64 concealment of the drop URL combined with a README cover-story describing it as a 'runtime patch asset' indicates deliberate hiding of the endpoint.

    References: https://www.npmjs.com/package/mfaby/v/1.0.0

    Affected packages

    Package

    Name: mfaby

    Purl: pkg:npm/mfaby

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0