Malicious code in mfakit (npm)

The 'mfakit' npm package (version 1.4.0) masquerades as a Discord MFA library but contains hidden malicious functionality. Upon loading, it executes code that decodes a URL and OS command tokens to download a script from a remote server. This script is saved in a hidden location under %APPDATA% and executed detached via node.exe. Persistence is established by creating a VBScript launcher in the user's Startup folder and adding registry Run keys under HKCU. The payload is periodically refreshed approximately every two hours. None of these malicious actions are disclosed in the package.json or README files.

This malicious package can lead to unauthorized code execution on affected Windows systems, persistent malware installation, and potential further compromise of the user's environment. The hidden nature of the payload and its persistence mechanisms increase the risk of prolonged undetected presence.

Users should immediately uninstall version 1.4.0 of the 'mfakit' package and remove any associated files and registry entries created by the malware. Avoid using this package entirely as it contains undisclosed malicious behavior. Since no patch or official fix is available, remediation involves removing the malicious package and cleaning the system manually.