Which versions of mfa.io are malicious?

The following npm versions of mfa.io are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate mfa.io if I installed it?

mfa.io is a typosquat — you almost certainly intended a legitimately-named package. Remove mfa.io, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed mfa.io — how do I know if it already compromised me?

If mfa.io was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is mfa.io part of a known attack campaign?

Yes — mfa.io is associated with the IN-MAL-2026-019301, IN-MAL-2026-019297 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find mfa.io across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for mfa.io (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging mfa.io across your stack and pipelines.

Malicious package

mfa.ionpm

mfa.io is a confirmed malicious npm package (MAL-2026-15628) that typosquats a legitimate package to trick installs (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in mfa.io (npm)

MAL-2026-15628

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall mfa.io

What this malware does

lib/cache.js reconstructs a base64-fragmented URL (decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y) and, the first time cache.get() is invoked, downloads the response, writes it to %APPDATA%/Roaming/Microsoft/Windows/WinSxS/Backup/WinSvcHost.js, and launches it with child_process.execFile against the current Node executable using detached:true, windowsHide:true, and creationFlags 0x08000008 so it runs as a hidden background process. The destination URL, the APPDATA/WinSxS/Backup path segments, the WinSvcHost.js filename, and the 'child_process' module identifier are all stored as base64 fragments and concatenated at runtime to hide intent from readers and string scanners. The one-shot fetch-and-execute chain is wired to the documented initMFA entry point, which reads _mfaStore.get(_ck) on entry, so any consumer using the advertised API triggers download and execution of attacker-hosted code from limbomail.com, a host unrelated to the package's declared purpose, with a Windows-system-lookalike drop location chosen to blend into legitimate OS folders.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

4a4baf37ef7131d4e796452b5091f1043d35306df8198dffc50060dfdcde5b3b

e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for mfa.io (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging mfa.io across your stack and pipelines.
If you installed it — respond
mfa.io is a typosquat — you almost certainly intended a legitimately-named package. Remove mfa.io, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If mfa.io was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks mfa.io before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. mfa.io on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019301IN-MAL-2026-019297

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks mfa.io-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database