The 'tilaver-mfa' npm package (version 1.0.0) includes a malicious index.js file that uses a custom VM-bytecode dispatcher with obfuscated identifiers. It targets Windows systems, harvesting sensitive data from Chromium-family browsers by decrypting DPAPI-protected blobs, extracting Discord tokens from local storage, and stealing Roblox cookies. It also captures screenshots and collects host information such as hostname, user info, and public IP. The collected data is exfiltrated to a hardcoded Discord webhook, a bare IP relay, and a file upload service. The package name does not justify the extensive credential theft, indicating malicious intent. Systems with this package installed should be considered fully compromised.

Systems with 'tilaver-mfa' version 1.0.0 installed are fully compromised. Sensitive credentials and tokens from multiple applications (browsers, Discord, Roblox) are stolen and sent to attacker-controlled endpoints. This leads to potential account takeovers, privacy breaches, and unauthorized access. Because the malware executes on module load and exfiltrates data immediately, any secrets or keys stored on the infected system are at risk and should be rotated from a clean environment.

Immediate removal of the 'tilaver-mfa' package is required. However, removal alone may not eliminate all malicious components or backdoors installed by the malware. All secrets, credentials, and keys stored on the compromised system must be rotated from a different, trusted device. Full system reimaging or restoration from a known good backup is recommended to ensure complete remediation.