Malicious code in mfacord (npm)

The 'mfacord' npm package (versions 1.0.2 and 1.0.3) contains embedded malicious functionality. Upon requiring the package, it loads code that on Windows decodes a hardcoded URL from obfuscated base64 and hex fragments. This URL points to a remote server (limbomail.com) from which a JavaScript payload is downloaded to the user's %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js file. The payload is executed via a generated VBScript (wsvc.vbs) launched through wscript.exe, which spawns node.exe. TLS certificate verification is disabled (rejectUnauthorized:false), and no integrity checks are performed on the downloaded payload. The package polls the URL approximately every two hours to update and relaunch the payload if changed. It installs multiple Windows persistence mechanisms targeting the dropped script, including a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), a user environment logon script (UserInitMprLogonScript), a scheduled task triggered on logon, and a startup folder VBScript. All persistence artifacts use Microsoft-like names and are hidden with system and hidden attributes. Sensitive strings related to the attack are stored in obfuscated forms to evade static detection. The package's advertised functionality as a Discord MFA/TOTP helper is a cover for this malicious dropper and persistence behavior.

This malicious package enables remote code execution on affected Windows systems by downloading and executing arbitrary code without user consent or verification. The multiple persistence mechanisms ensure the payload survives reboots and user logins, allowing continuous control or compromise of the system. The disabling of TLS verification and lack of payload integrity checks increase the risk of man-in-the-middle attacks or payload tampering. The obfuscation techniques hinder detection by static analysis tools. Overall, this poses a significant security risk to users who install or depend on these package versions.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall 'mfacord' versions 1.0.2 and 1.0.3 and avoid using this package. Conduct a thorough system scan for the dropped files and persistence mechanisms described, including the 'winsvc.js' script in the AppData path, the 'wsvc.vbs' script in the Startup folder, and the registry and scheduled task entries. Remove any identified malicious artifacts. Consider blocking network access to the domain 'limbomail.com' to prevent payload downloads. Monitor for any suspicious processes such as wscript.exe or node.exe spawned in this context. Use trusted sources for MFA/TOTP helpers and verify package integrity before installation.