The 'tilaver-mfa' npm package version 1.0.0 includes a heavily obfuscated Windows infostealer in its index.js file. This malware executes immediately when the module loads, targeting Chromium-family browsers to extract Local State, Login Data, and Cookies by decrypting DPAPI-protected v10 blobs. It also harvests Discord tokens from local storage and Roblox cookies, captures screenshots, and collects host system identifiers such as hostname, user info, and public IP. The stolen data is exfiltrated to a hardcoded Discord webhook, a bare-IP relay, and a file hosting service. The package's legitimate purpose does not align with these actions, confirming it as malicious.

Sensitive user data including browser credentials, cookies, Discord tokens, and Roblox session cookies can be stolen. This leads to potential account compromise and unauthorized access to user accounts and services. The malware also captures screenshots and host identifiers, increasing privacy and security risks. The exfiltration to multiple external endpoints facilitates remote attacker control and data theft.

No official patch or remediation is currently available for this malicious package. Users and organizations should immediately remove 'tilaver-mfa' version 1.0.0 from their environments and avoid installing it. Monitor for any signs of compromise related to browser credentials, Discord, or Roblox accounts. Use trusted sources for npm packages and verify package integrity before installation.