# MAL-2026-17864: Malicious code in passwordcracker (npm)


- **Type:** Malicious package
- **Package:** `passwordcracker` (npm)
- **Published:** 10 Oct 2026

## What is MAL-2026-17864?

MAL-2026-17864 is a malicious package in passwordcracker, published on 10 Oct 2026. 

### Official description

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs `try{module['require']('node-net-pool')}catch(_){}` to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcracker and passwordcrackv2 with identical code on 2026-10-09 and 2026-10-10.

package.json at line 41 declares the sole runtime dependency `node-net-pool` as an off-registry HTTPS tarball pointing at the `main` branch of https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz, with no version pin, no commit SHA, and no integrity hash. On `npm install`, npm fetches whatever that mutable branch currently contains and installs it, running any lifecycle scripts inside the resulting package. The GitHub account hosting the tarball is unrelated to any established publisher, and the shipped source references pool functionality that is not implemented locally, so the external tarball supplies code that this package depends on at runtime. The package also ships an index.js that targets Discord's `/api/v9/mfa/finish` and vanity-url endpoints with caller-supplied token and password values and disables TLS verification against discord.com, canary.discord.com, and ptb.discord.com — an offensive tool operating on operator-supplied credentials rather than installer-owned data, which does not by itself attack the installer but confirms the package's hostile posture.

## What should I do about MAL-2026-17864?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17864 is a malicious package: passwordcracker (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17864/ (Markdown: https://insights.sbomify.com/MAL-2026-17864/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17864

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17864/
Summaries are generated and may contain mistakes; the official description above is the record.