MalwarePublished 9 Oct 2026Updated 29 Oct 2026

passwordcrackv2 (npm) · Malicious Code

Affects passwordcrackv2Source GCVE Database

Malicious package : remove passwordcrackv2 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:07 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17865

What to do

Remove passwordcrackv2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpasswordcrackv2	Affected =1.1.1 =1.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package passwordcrackv2 masquerades as a dependency-free Discord MFA library but includes a malicious dependency fetched from an attacker-controlled GitHub repository. This dependency executes code on load, and on Windows systems, it downloads and runs a hidden script that persists via multiple autorun mechanisms and checks for updates regularly. The package was published by the npm account kingsize on 2026-10-09 and 2026-10-10 with identical malicious code. This behavior enables remote code execution on the installer's system regardless of the intended Discord MFA functionality.

Impact

This threat enables arbitrary code execution on the system of anyone installing or using the passwordcrackv2 package. The malicious payload downloads and runs additional scripts, establishes persistence on Windows systems via multiple autorun mechanisms, and maintains regular update checks. This can lead to system compromise, unauthorized access, and potential further malicious activity. The attack targets the supply chain by injecting malicious code into a package that appears legitimate, affecting developers or users who install it.

Defensive guidance

Users should immediately uninstall passwordcrackv2 and passwordcracker packages from their environments. Avoid installing packages from untrusted or unknown npm accounts, especially those that fetch dependencies from mutable branches without integrity checks. Monitor for and remove any persistence mechanisms described (hidden scripts, registry autorun entries, startup shortcuts) on affected Windows systems. Consider scanning systems for the presence of the malicious files and scripts described. Review and restrict npm package sources and dependencies to trusted repositories with pinned versions and integrity verification.

Summary

passwordcrackv2 is a malicious npm package that pretends to be a Discord MFA library but pulls a dependency named 'node-net-pool' from an attacker-controlled GitHub repository without version pinning or integrity verification. The package's code loads this dependency silently, enabling arbitrary code execution during installation and runtime. On Windows, the malicious code downloads a script from a remote URL, saves it as a hidden file, executes it via a hidden VBScript, and establishes persistence through multiple registry autorun keys and startup shortcuts. It also periodically updates itself every two hours. The npm publisher (kingsize) and the dependency owner (lunexindonesia) are unrelated, indicating a supply chain compromise. Amazon Inspector identified similar malicious loader code in another package, discord-mfa-solver (MAL-2026-16100).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:07 UTC

Technical details

References

Community reviews