MAL-2026-16100

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e) On require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.