Malicious code in mfa-js (npm)

The mfa-js package (versions 1.0.3 and 1.0.4) includes a malicious module (lib/cache.js) that executes immediately upon requiring the package. It downloads a JavaScript payload from a remote URL to a hidden location in the Windows AppData directory and executes it via wscript.exe and a VBS wrapper that invokes node.exe. The package installs four persistence mechanisms to ensure the payload runs on system logon: a registry Run key, an environment variable UserInitMprLogonScript, a startup folder VBS script, and a scheduled task. The malicious code periodically checks the remote payload URL for updates, downloads new code if available, kills the previous process, and relaunches the updated payload, enabling continuous mutable remote code execution. Sensitive strings and URLs are obfuscated via hex escapes and base64 encoding. This behavior occurs without any install script, triggered simply by requiring the package.

Systems with this package installed are fully compromised, allowing an attacker persistent remote code execution and control. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of the malicious payload or persistence mechanisms, as full system compromise is likely.

Immediate removal of the mfa-js package versions 1.0.3 and 1.0.4 is required. All credentials and secrets stored on affected systems should be rotated from a different, trusted machine. Due to multiple persistence mechanisms and full system compromise, a thorough forensic investigation and system rebuild or wipe is recommended to ensure complete removal of the malware. No official patch or fix is available; remediation relies on removal and recovery procedures.