The npm package 'passwordcracker' is a malicious package masquerading as a dependency-free Discord MFA library. It pulls and executes code from an attacker-controlled GitHub repository and, on Windows systems, downloads and runs a hidden script that persists through multiple startup mechanisms and checks for updates regularly. It also contains offensive functionality targeting Discord API endpoints with operator-supplied credentials and disables TLS verification for Discord domains. The package was published by the npm account 'kingsize' with identical malicious code in versions 1.0.0 and 1.1.1.