MAL-2026-16102 Malicious code in mfatest2 (npm)

package.json declares its only runtime dependency as an unpinned GitHub ref ("node-net-pool": "github:trktgq0wbre1/node-net-pool") pointing at a random-handle user account, contradicting the package's own 'Zero runtime dependencies — pure Node.js built-ins only' claim in the README. npm install resolves whatever HEAD of that repository currently returns, and lib/cache.js executes a top-level require of that dependency inside a swallowed try/catch, using the bracketed form module['require']('node-net-pool') that evades naive grep for require('node-net-pool'). The README documents an 'Asset prefetch' step in which the loaded dependency resolves a remote endpoint from an internal segment registry, downloads a 'runtime patch asset', and executes it as a detached background worker via child_process.execFile — placing the fetch-and-execute mechanism inside the mutable off-registry dependency that the author can update at any time. The package advertises Discord MFA / vanity-URL sniping, a category where such mislabeled-dependency channels are routinely used to smuggle credential-stealer code.