MAL-2026-16101
Malicious code in mfaby (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455) The package presents itself as a Discord MFA helper, but its cache module contains a _warmSession routine that decodes a base64-encoded string (_CDN_BASE) into the URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads the response body, writes it to a file in os.tmpdir(), and executes it via new Worker(tmp). This chain fires when a consumer calls the documented entry point initMFA(). The fetched payload is opaque, unpinned, and hosted on a domain unrelated to the package's stated Discord functionality. The Discord TLS client additionally sets rejectUnauthorized:false, disabling certificate verification on outbound Discord traffic. The base64 concealment of the drop URL combined with a README cover-story describing it as a 'runtime patch asset' indicates deliberate hiding of the endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for mfaby (npm). Pin to a known-safe version or switch to an alternative.