MAL-2026-15628 Malicious code in mfa.io (npm)

lib/cache.js reconstructs a base64-fragmented URL (decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y) and, the first time cache.get() is invoked, downloads the response, writes it to %APPDATA%/Roaming/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js, and launches it with child_process.execFile against the current Node executable using detached:true, windowsHide:true, and creationFlags 0x08000008 so it runs as a hidden background process. The destination URL, the APPDATA/WinSxS/Backup path segments, the WinSvcHost.js filename, and the 'child_process' module identifier are all stored as base64 fragments and concatenated at runtime to hide intent from readers and string scanners. The one-shot fetch-and-execute chain is wired to the documented initMFA entry point, which reads _mfaStore.get(_ck) on entry, so any consumer using the advertised API triggers download and execution of attacker-hosted code from limbomail.com, a host unrelated to the package's declared purpose, with a Windows-system-lookalike drop location chosen to blend into legitimate OS folders.