discord-mfa-solver

{"schema_version":"1.7.4","id":"MAL-2026-16100","published":"2026-09-09T21:10:15Z","modified":"2026-09-28T06:56:31.037714500Z","aliases":["GHSA-vf4w-775x-ccfh"],"summary":"Malicious code in discord-mfa-solver (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e)\nOn require of the package, lib/cache.js (reached from index.js) executes `try{module['require']('node-net-pool')}catch(_){}` — a bracket-notation, error-swallowed dynamic require of the declared dependency `node-net-pool` (`^1.0.0` in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code `node-net-pool` runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via `child_process.execFile`, but no such code (no `_SEGS`, no `_pullAsset`, no `_spawnWorker`, no `child_process` usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed `node-net-pool`. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish` with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.\n\n## Source: ghsa-malware (59a6cc9b3233c6e824a129b910428abecf200adf505a9fe251afc688ec4fb66a)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"discord-mfa-solver","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.2","1.0.1","1.0.0","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"b63137e30dc39ef6b5431a8d846a3a0133467670e8da288bb43a1b6d64d5574d","tlsh":"49219b36c8e46e6b17c965a0e815a052f73224474c0e7d00339742addf8f0eb32be55e"},{"path":"index.js","sha256":"52583b62314f049289a83dfe59ef488e587deea24c45a783a099b953f7631698","tlsh":"a412621121f7203a0363d0ff9bd7d01567345903355ae9b8b78c9684afc361a85b3aee"}],"package_integrity":[{"filename":"discord-mfa-solver-1.0.2.tgz","hashes":{"sha1":"55cda21b75e86d78a457164466a85bee444dbef5","sha512_sri":"sha512-sTFq7lO+awI+gAByZ9EjSa8cputunQ877e0FB19D3FDD2Dj/SaCiVgj8alx9R668JKLvEUBPdoi7AlQDx58KOA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/discord-mfa-solver/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discord-mfa-solver/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discord-mfa-solver/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/discord-mfa-solver/v/1.0.3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vf4w-775x-ccfh"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019898","import_time":"2026-09-09T21:14:32.877614419Z","modified_time":"2026-09-09T21:10:25Z","sha256":"447fc485deb497c4e8b7310efa4dd48c82c67bdb1b063ef3afa8b183519b191b","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-019899","import_time":"2026-09-09T21:14:32.901127604Z","modified_time":"2026-09-09T21:10:33Z","sha256":"a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-019897","import_time":"2026-09-09T21:14:32.850826094Z","modified_time":"2026-09-09T21:10:15Z","sha256":"f225d62852a2181e36cbea8fbe07ea23921cf1ba07e84eb7dd3cef030cd9c6d9","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-020022","import_time":"2026-09-14T16:40:44.457831637Z","modified_time":"2026-09-14T16:34:27Z","sha256":"397e64d0ed82bfc13ede94f1c8bd90c12072b12e11657afca16872a92423188a","source":"amazon-inspector","versions":["1.0.3"]},{"id":"GHSA-vf4w-775x-ccfh","import_time":"2026-09-28T06:54:43.475397559Z","modified_time":"2026-09-28T06:04:40Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"59a6cc9b3233c6e824a129b910428abecf200adf505a9fe251afc688ec4fb66a","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}