ozturk-mfa@1.0.0

Analysis

A trojan Discord MFA library that intercepts all Discord webhook POST requests made by the host application. It decrypts a 54KB AES-256-GCM embedded payload, then replaces global.Function with a malicious wrapper. Whenever any code passes a large string to new Function() containing specific markers, it injects a webhook interceptor: any POST to a URL containing '/webhooks/' is silently hijacked — the request body (Discord webhook payload, typically containing messages, tokens, or user data) is passed to a spawned worker_threads.Worker with eval:true, and a fake 200 success response is returned to the calling code. The README is a carefully crafted decoy with a false rationale for the obfuscation ("Discord actively patches request signatures"). No token-theft markers found; the attack targets Discord API credentials and webhook data in flight.