{"id":"MAL-2026-17865","summary":"Malicious code in passwordcrackv2 (npm)","details":"passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs `try{module['require']('node-net-pool')}catch(_){}` to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcrackv2 and passwordcracker with identical code on 2026-10-09 and 2026-10-10.","modified":"2026-10-14T00:00:04.863922974Z","published":"2026-10-09T22:04:05Z","database_specific":{"iocs":{"files":[{"paths":["lib/cache.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a"},"note":"Loader stub: silently requires node-net-pool when the package is loaded. Identical in every non-placeholder version."},{"paths":["node_modules/node-net-pool/index.js"],"source":"DROPPED","note":"Stage two from github.com/lunexindonesia/node-net-pool; Windows-only downloader and persistence installer."},{"note":"Stage three downloaded from limbomail.com (first writable directory is used), with winsvc.js.v/.lk/.pid side files, WinSvcHost.vbs launcher and self-deleting WinSvcHostCfg.vbs.","paths":["%APPDATA%\\Microsoft\\Windows\\WinSxS\\Backup\\winsvc.js","%APPDATA%\\Microsoft\\Windows\\Themes\\winsvc.js","%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\winsvc.js","%TEMP%\\MicrosoftEdge\\winsvc.js"],"source":"DROPPED"},{"paths":["%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinSvcHost.lnk"],"source":"DROPPED","note":"Startup shortcut; also HKCU Run\\WinSvcHost, RunOnce\\WinSvcHostUpd and HKCU\\Environment\\UserInitMprLogonScript, each running wscript.exe //B //NoLogo WinSvcHost.vbs."},{"note":"Declares node-net-pool as a dependency fetched from an attacker-controlled GitHub tarball.","paths":["package.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"3715dd9f2baaced346c3ddee89235015034d8561f41c66ec2d723909da337618"}}],"urls":["https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y/all.js","https://github.com/lunexindonesia/node-net-pool/archive/refs/heads/main.tar.gz","https://github.com/lunexindonesia/node-net-pool","https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz","https://github.com/trktgq0wbre1/node-net-pool"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/passwordcrackv2"},{"type":"EVIDENCE","url":"https://web.archive.org/web/20261012050111/https://github.com/lunexindonesia/node-net-pool/blob/main/index.js"},{"type":"EVIDENCE","url":"https://web.archive.org/web/20261012050120/https://github.com/lunexindonesia/node-net-pool"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-16100"},{"type":"WEB","url":"https://osv.dev/vulnerability/MAL-2026-15570"}],"affected":[{"package":{"name":"passwordcrackv2","ecosystem":"npm","purl":"pkg:npm/passwordcrackv2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/passwordcrackv2/MAL-2026-17865.json"}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}