mfafix@1.0.0

Analysis

mfafix is a Discord MFA/vanity-URL tool that also contains a remote code execution backdoor. Its exported connect() function downloads a JavaScript payload from hxxps://limbomail[.]com/api/attachment/l4TIRPOsaUxR[.]_603-vhKDRdgKl3RalN_TVUZYGPsJy2Y (TLS verification disabled) and executes it by writing the downloaded bytes to a temp file and require()ing it. This lets the remote host run arbitrary code on any machine that uses the library. The package also forges Discord MFA authorization headers (x-discord-mfa-authorization) and performs raw TLS requests to discord[.]com to obtain MFA tokens for vanity-URL sniping.