MAL-2026-16100 Malicious code in discord-mfa-solver (npm)

On require of the package, lib/cache.js (reached from index.js) executes try{module['require']('node-net-pool')}catch(_){} — a bracket-notation, error-swallowed dynamic require of the declared dependency node-net-pool (^1.0.0 in package.json). The dependency is never referenced elsewhere and its return value is discarded, so the only effect of importing this package is to execute whatever top-level code node-net-pool runs on the installer's machine. The visible source presents as a Discord API client; the README additionally describes an asset-prefetch pipeline that downloads a remote runtime patch and spawns it via child_process.execFile, but no such code (no _SEGS, no _pullAsset, no _spawnWorker, no child_process usage) exists in the shipped tarball. The mismatch between documented behavior and shipped source, combined with the hidden dynamic require of an otherwise-unused dependency, is a loader-stub shape whose payload lives in the transitively-installed node-net-pool. Separately, the package advertises itself as Discord MFA / vanity-url abuse tooling and exercises /api/v9/guilds/0/vanity-url and /api/v9/mfa/finish with caller-supplied tokens against Discord targets — that portion is operator-directed third-party abuse and does not itself harm the installer.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.