Which versions of discord-mfa are malicious?

The following npm versions of discord-mfa are flagged malicious: 3.0.0, 3.0.1. Treat any of these as compromised.

How do I remediate discord-mfa if I installed it?

discord-mfa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed discord-mfa — how do I know if it already compromised me?

If discord-mfa was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is discord-mfa part of a known attack campaign?

Yes — discord-mfa is associated with the IN-MAL-2026-019129, IN-MAL-2026-019133 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find discord-mfa across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for discord-mfa (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging discord-mfa across your stack and pipelines.

Malicious package

discord-mfanpm

discord-mfa is a confirmed malicious npm package (MAL-2026-15552) that steals credentials and exfiltrates sensitive data (malicious versions 3.0.0, 3.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in discord-mfa (npm)

MAL-2026-15552

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall discord-mfa

What this malware does

On require('discord-mfa'), index.js loads lib/cache.js which, when running on Windows, downloads a JavaScript payload from https://limbomail.com/api/attachment/r_Ea6rT_kGfT.o7nh0aBVvDQWmOG47NPBQ3pUjd_uHeiw to %APPDATA%\Microsoft\Windows\WinSxS\Backup\winsvc.js and executes it via node.exe launched through a hidden wscript.exe/VBS shim. lib/totp.js then installs four independent persistence mechanisms so the fetched payload re-executes on every logon: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinSvcHost registry value, an HKCU\Environment\UserInitMprLogonScript entry, a hidden/system-flagged wsvc.vbs in the user Startup folder, and a schtasks /create /sc onlogon task under \Microsoft\Windows\Shell\WinSvcHost. Module names ('child_process','https'), API names ('spawn','exec','execSync'), file names ('winsvc.js','node.exe','wsvc.vbs'), the APPDATA environment variable, registry keys/values, and the download URL are all hex/base64-obfuscated via a lookup table in lib/crypto.js. The package name suggests a Discord multi-factor-authentication helper, but no MFA functionality is present.

Malicious versions

2 flagged

3.0.03.0.1

Indicators of compromise (SHA-256)

cb4ed3f4fab9ec795405127517bce22b0aad8277ba7db65a563d311660334760

e7104822a8540efb9e4a4c17a5cad7bc2a1639728e6bd51f93fdf9d7cf2a81d1

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for discord-mfa (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging discord-mfa across your stack and pipelines.
If you installed it — respond
discord-mfa is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If discord-mfa was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks discord-mfa before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. discord-mfa on npm has been identified as a malicious package (versions 3.0.0, 3.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019129IN-MAL-2026-019133

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks discord-mfa-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database