MAL-2026-15557 Malicious code in mfacord (npm)

On require('mfacord'), index.js loads lib/cache.js, which on win32 decodes a hardcoded URL (https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw) from base64/hex fragments and downloads the response to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js, then launches it via a generated wsvc.vbs invoked through wscript.exe spawning node.exe. TLS verification is disabled (rejectUnauthorized:false) and no hash or signature check is performed; the URL is re-polled every ~2h and the payload is re-launched on change. lib/totp.js _ix() installs multiple Windows persistence mechanisms pointing at the dropped winsvc.js: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value 'WinSvcHost', an HKCU\Environment 'UserInitMprLogonScript' logon script, a scheduled task at \Microsoft\Windows\Shell\WinSvcHost with an onlogon trigger, and a wsvc.vbs dropped into the user's Startup folder, with files marked hidden+system under Microsoft-lookalike names. Sensitive identifiers — 'child_process', 'https', 'wscript.exe', 'APPDATA', the Microsoft/Windows/WinSxS/Backup path segments, 'winsvc.js', 'node.exe', the limbomail.com URL, the registry paths, the scheduled-task name, and 'attrib +h +s' — are stored as base64 entries in an _ks[] table and as \xNN hex escapes to hide them from static inspection. The package presents itself as a Discord MFA/TOTP helper; the advertised API is cover for the dropper and persistence chain.