mfatest2

{"modified":"2026-09-09T21:10:52Z","published":"2026-09-09T21:10:52Z","schema_version":"1.7.4","id":"MAL-2026-16102","summary":"Malicious code in mfatest2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15)\npackage.json declares its only runtime dependency as an unpinned GitHub ref (`\"node-net-pool\": \"github:trktgq0wbre1/node-net-pool\"`) pointing at a random-handle user account, contradicting the package's own 'Zero runtime dependencies — pure Node.js built-ins only' claim in the README. npm install resolves whatever HEAD of that repository currently returns, and lib/cache.js executes a top-level require of that dependency inside a swallowed try/catch, using the bracketed form `module['require']('node-net-pool')` that evades naive grep for require('node-net-pool'). The README documents an 'Asset prefetch' step in which the loaded dependency resolves a remote endpoint from an internal segment registry, downloads a 'runtime patch asset', and executes it as a detached background worker via child_process.execFile — placing the fetch-and-execute mechanism inside the mutable off-registry dependency that the author can update at any time. The package advertises Discord MFA / vanity-URL sniping, a category where such mislabeled-dependency channels are routinely used to smuggle credential-stealer code.\n","affected":[{"package":{"ecosystem":"npm","name":"mfatest2"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"9cf3f0ac63ca057630dc55c150cb3e91d59f6e72ee1a3cbac46f45c1a71b4a98","tlsh":"48216636c8f85c5327d52690a9194193f673081b0949bc11738a827d8fdd1af26ff16e"},{"path":"lib/cache.js","sha256":"40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a","tlsh":"1f416c5f39c1f0261bf7a57da91f874ab76c990c200cd5a0796943ecba3213c47b7859"},{"path":"README.md","sha256":"5e60650cafc34b11efcef3d7a355c77dc18bbe2f09d6c6891b7907fbbd3e59df","tlsh":"90f1f6331e53347a3ef7c296f7412991ff22500d531660a0b45e90ada34a3e1cb6f6d6"}],"package_integrity":[{"filename":"mfatest2-1.0.0.tgz","hashes":{"sha1":"ef869c62f8fb5ab92710bccd6f2026f6a014e515","sha512_sri":"sha512-vrBawjpmdAtkduze56yAWghaREc21OFbbvcq4fjH/qendvocqBRDYmNW0p1NUOLg2Q4CJpXpVUjDHdTSjwUP6w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mfatest2/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019901","import_time":"2026-09-09T21:14:32.954673352Z","modified_time":"2026-09-09T21:10:52Z","sha256":"8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15","source":"amazon-inspector","versions":["1.0.0"]}]}}