The npm package passwordcrackv2 masquerades as a dependency-free Discord MFA library but includes a malicious dependency fetched from an attacker-controlled GitHub repository. This dependency executes code on load, and on Windows systems, it downloads and runs a hidden script that persists via multiple autorun mechanisms and checks for updates regularly. The package was published by the npm account kingsize on 2026-10-09 and 2026-10-10 with identical malicious code. This behavior enables remote code execution on the installer's system regardless of the intended Discord MFA functionality.