Malicious code in discord-mfa (npm)

The discord-mfa npm package (versions 3.0.0 and 3.0.1) includes malicious code that triggers on Windows platforms. Upon requiring the package, index.js loads lib/cache.js, which downloads a JavaScript payload from a remote URL to the user's %APPDATA% directory. The payload is executed via node.exe launched through a hidden wscript.exe/VBS shim. Persistence is established through four independent methods: a registry Run key, a UserInitMprLogonScript environment variable, a hidden VBS script in the Startup folder, and a scheduled task. The package uses hex/base64 obfuscation for module names, API calls, file names, environment variables, registry keys, and the download URL. Despite its name suggesting Discord multi-factor authentication support, it provides no such functionality and instead acts as malware.

The malicious package results in unauthorized code execution on Windows systems, enabling persistent execution of a potentially harmful JavaScript payload. This can lead to system compromise, unauthorized access, or further malicious activity. The persistence mechanisms ensure the payload runs on every user logon, increasing the risk of prolonged infection.

Users should immediately uninstall the discord-mfa package versions 3.0.0 and 3.0.1. Since no official patch or remediation is indicated, avoid using this package entirely. Remove any artifacts left by the malware, including the downloaded winsvc.js file, the registry Run key, the UserInitMprLogonScript environment variable, the hidden wsvc.vbs script in the Startup folder, and the scheduled task named WinSvcHost. Conduct a thorough system scan for additional compromise. Monitor for any suspicious activity related to node.exe or wscript.exe processes.