mfaatest@1.0.0

Analysis

mfaatest@1.0.0 declares a runtime dependency "node-net-pool" fetched from a non-registry host (hxxps://limbomail[.]com/api/attachment/fpwvxc__9DvM[.]Bjuueu1K2SkBC_KkgATls-oq05UsrNNY/pkg[.]tgz) and loads it via require() when the package is imported, executing attacker-controlled code from that host. The package is also a Discord MFA/vanity-URL-sniping tool: it accepts a Discord user token and account password, requests MFA tickets from Discord's API (PATCH /api/v9/guilds/0/vanity-url, POST /api/v9/mfa/finish), and emits x-discord-mfa-authorization headers for PATCHing guild vanity URLs, i.e. it automates abuse of Discord accounts and their MFA credentials.