MAL-2026-15630 Malicious code in mfafix (npm)

lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow (which reaches cache.get() via _mfaStore.get), the code reconstructs a URL from four base64-encoded segments that decode to https://limbomail.com/api/attachment/…, downloads a JavaScript payload, writes it to %APPDATA%\Microsoft\Windows\WinSxS\Backup\WinSvcHost.js, and launches it under the host Node.js executable via child_process.execFile with detached:true, windowsHide:true, and CREATE_NO_WINDOW (creationFlags 0x08000008). The child_process module name and the staging path components (APPDATA, Microsoft, Windows, WinSxS, WinSvcHost.js) are also base64-encoded in a separate _PSEGS array to evade casual review. The destination host limbomail.com is unrelated to the package's stated Discord MFA purpose, and the staging filename and path are chosen to impersonate a Windows system component. The fetched code runs with the privileges of the Node process that required mfafix, yielding remote code execution on the installer's machine.