MAL-2026-17865
Malicious code in passwordcrackv2 (npm)
Published Oct 9, 2026 · updated Oct 14, 2026
passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcrackv2 and passwordcracker with identical code on 2026-10-09 and 2026-10-10.
Timeline
Detection, updates, and resolution for this record.
Oct 9, 2026 · Catalog
Detected
passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists thro
Oct 14, 2026 · Catalog
Updated
passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists thro
Affected
- npm passwordcrackv2version unspecified