Supply chain · npm · High

Malicious npm package 'mfakit' (v1.4.0) targets Windows systems for persistent compromise

Threat Engine Auto-Feed · data current as of 2026-08-29

The npm package 'mfakit' version 1.4.0, masquerading as a Discord MFA library, contains malicious code that establishes persistence on Windows systems. It downloads and executes a script, hiding it and ensuring it runs at startup and on a recurring schedule, posing a critical supply-chain risk for users of this package.

  • Package: npm / mfakit
  • Affected versions: = 1.4.0
  • Severity: critical
  • Reach: ~611/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'mfakit' version 1.4.0, despite advertising itself as a lightweight Discord MFA library with zero dependencies, contains undisclosed malicious functionality. Upon installation and execution on Windows systems, it downloads a script, hides it, and establishes multiple persistence mechanisms to ensure its continuous execution.

How the attack works

This is a software supply-chain attack where a seemingly legitimate package is compromised or created with malicious intent. When the package is installed and run, it executes hidden code that downloads an external script. This script is then concealed on the system, configured to run automatically at startup, and periodically re-fetched and executed, allowing for persistent unauthorized activity.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull npm packages, especially 'mfakit'
  • Any system where 'mfakit' version 1.4.0 has been installed and executed, particularly Windows environments

Conditions that increase exposure

  • Unpinned dependencies that allow automatic updates to vulnerable versions
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not vet packages for malicious content
  • Execution of 'mfakit' on Windows operating systems

Blast-radius scenarios

  • An attacker gains persistent execution capabilities on compromised Windows systems.
  • The downloaded script could be updated by the attacker, leading to evolving threats such as credential theft, data exfiltration, or further system compromise.
  • The hidden and persistent nature of the payload makes detection and removal challenging, potentially leading to long-term compromise.

What to do (defensive)

Detect

  • Scan project dependencies for 'mfakit' version 1.4.0.
  • Monitor network traffic for connections to 'https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw'.
  • Inspect Windows systems for the presence of 'winsvc.js' in '%APPDATA%\Microsoft\Windows\WinSxS\Backup\' and '.vbs' files in the user's Startup folder.
  • Check Windows registry keys (HKCU Run) for suspicious entries related to 'winsvc.js' or 'mfakit'.

Contain

  • Immediately quarantine or isolate any systems identified with 'mfakit' version 1.4.0 installed.
  • Block network access to 'https://limbomail.com' at the perimeter.
  • Remove 'mfakit' version 1.4.0 from all project dependencies and package registries.
  • Implement strict egress filtering to prevent unauthorized outbound connections.

Remediate

  • Remove 'mfakit' version 1.4.0 from all affected projects and rebuild applications with a clean dependency tree.
  • On affected Windows systems, remove the 'winsvc.js' file, any associated '.vbs' launcher scripts, and malicious registry entries.
  • Perform a thorough forensic analysis on compromised systems to identify the full extent of the breach and any further payloads.
  • Rotate all credentials that may have been exposed on compromised systems.

Frontier verdict — High

Prioritize immediate detection and removal of 'mfakit' v1.4.0 due to its critical severity and persistent compromise capabilities on Windows systems.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.