mfa.io

{"modified":"2026-08-31T18:24:27Z","published":"2026-08-31T18:01:21Z","schema_version":"1.7.4","id":"MAL-2026-15628","summary":"Malicious code in mfa.io (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436)\nlib/cache.js reconstructs a base64-fragmented URL (decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y) and, the first time cache.get() is invoked, downloads the response, writes it to %APPDATA%/Roaming/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js, and launches it with child_process.execFile against the current Node executable using detached:true, windowsHide:true, and creationFlags 0x08000008 so it runs as a hidden background process. The destination URL, the APPDATA/WinSxS/Backup path segments, the WinSvcHost.js filename, and the 'child_process' module identifier are all stored as base64 fragments and concatenated at runtime to hide intent from readers and string scanners. The one-shot fetch-and-execute chain is wired to the documented initMFA entry point, which reads _mfaStore.get(_ck) on entry, so any consumer using the advertised API triggers download and execution of attacker-hosted code from limbomail.com, a host unrelated to the package's declared purpose, with a Windows-system-lookalike drop location chosen to blend into legitimate OS folders.\n","affected":[{"package":{"ecosystem":"npm","name":"mfa.io"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/cache.js","sha256":"01af6b25fbb8ce5c02f4a3a55cb9f489282a042bcf05c1a72d9afed570db10ea","tlsh":"00c1851b36c1b2374aa3a2f8694f9297b31a84083194c1b0b47d42e87f2157d83b3cdc"}],"package_integrity":[{"filename":"mfa.io-1.0.0.tgz","hashes":{"sha1":"52285b3ef3ba0675ff1fd7664248181743dfbb1a","sha512_sri":"sha512-uXrMVQdiKaZFKpZsUbJzDY/o0yWuKuvVyQlyxKMskevhzBp/4EXblbdWZdc6vCwPXy/Rj48CtR33z8Zxp9jrvQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mfa.io/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/mfa.io/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019301","import_time":"2026-08-31T18:22:29.357478057Z","modified_time":"2026-08-31T18:02:02Z","sha256":"4a4baf37ef7131d4e796452b5091f1043d35306df8198dffc50060dfdcde5b3b","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-019297","import_time":"2026-08-31T18:22:29.223679691Z","modified_time":"2026-08-31T18:01:21Z","sha256":"e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436","source":"amazon-inspector","versions":["1.0.1"]}]}}