{"id":"MAL-2026-17864","summary":"Malicious code in passwordcracker (npm)","details":"passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs `try{module['require']('node-net-pool')}catch(_){}` to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcracker and passwordcrackv2 with identical code on 2026-10-09 and 2026-10-10.","modified":"2026-10-14T00:00:04.862569140Z","published":"2026-10-10T00:14:23Z","database_specific":{"iocs":{"urls":["https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y/all.js","https://github.com/lunexindonesia/node-net-pool/archive/refs/heads/main.tar.gz","https://github.com/lunexindonesia/node-net-pool","https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz","https://github.com/trktgq0wbre1/node-net-pool"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a"},"note":"Loader stub: silently requires node-net-pool when the package is loaded. Identical in every non-placeholder version.","paths":["lib/cache.js"]},{"note":"Stage two from github.com/lunexindonesia/node-net-pool; Windows-only downloader and persistence installer.","paths":["node_modules/node-net-pool/index.js"],"source":"DROPPED"},{"paths":["%APPDATA%\\Microsoft\\Windows\\WinSxS\\Backup\\winsvc.js","%APPDATA%\\Microsoft\\Windows\\Themes\\winsvc.js","%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\winsvc.js","%TEMP%\\MicrosoftEdge\\winsvc.js"],"source":"DROPPED","note":"Stage three downloaded from limbomail.com (first writable directory is used), with winsvc.js.v/.lk/.pid side files, WinSvcHost.vbs launcher and self-deleting WinSvcHostCfg.vbs."},{"paths":["%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinSvcHost.lnk"],"source":"DROPPED","note":"Startup shortcut; also HKCU Run\\WinSvcHost, RunOnce\\WinSvcHostUpd and HKCU\\Environment\\UserInitMprLogonScript, each running wscript.exe //B //NoLogo WinSvcHost.vbs."},{"digests":{"sha256":"8e3a8f364d1d5ef4b18b3d67268e11916601b16548cae6bda593da79fcf4fe87"},"note":"Declares node-net-pool as a dependency fetched from an attacker-controlled GitHub tarball.","paths":["package.json"],"source":"PACKAGE_ARCHIVE"}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/passwordcracker"},{"type":"EVIDENCE","url":"https://web.archive.org/web/20261012050111/https://github.com/lunexindonesia/node-net-pool/blob/main/index.js"},{"type":"EVIDENCE","url":"https://web.archive.org/web/20261012050120/https://github.com/lunexindonesia/node-net-pool"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-16100"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-15570"}],"affected":[{"package":{"name":"passwordcracker","ecosystem":"npm","purl":"pkg:npm/passwordcracker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/passwordcracker/MAL-2026-17864.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}