GCVE-110-OSM-2026-13620

passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs `try{module['require']('node-net-pool')}catch(_){}` to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcrackv2 and passwordcracker with identical code on 2026-10-09 and 2026-10-10. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "node-net-pool": "https://github.com/lunexindonesia/node-net-p..." EXFIL - Data Encoding for Exfiltration in lib/crypto.js: "Buffer.from(data).toString('base64')" - Data Encoding for Exfiltration in lib/http.js: "encodeURIComponent(k) + '=' + encodeURIComponent(v" - Data Encoding for Exfiltration in lib/totp.js: "encodeURIComponent(issuer || '')}:${encodeURIComponent(account)}?${qs" - Network Request in [node-net-pool] index.js: "https.request(" - System Information Collection in [node-net-pool] index.js: "process.platform" OBFUSCATION - Dynamic Base64 Decoding in lib/crypto.js: "Buffer.from(data, 'base64')" - Decoded Base64 Content in index.js - Decoded Base64 Content in lib/crypto.js - Decoded Base64 Content in [deobfuscated] lib/crypto.js - Base64 Encoded Payload in index.js: "'eyJicm93c2VyIjoiQ2hyb21lIiwiYnJvd3Nlcl91c2VyX2FnZW50IjoiQ2hyb21lIiwiY2xpZW50X2J..." - Strings Extracted from Deobfuscated Code in lib/crypto.js - recovered 1 ipv4, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Stealth Background Process Spawning in [node-net-pool] index.js: "spawn( "reg.exe", [ "ADD", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\..." - Very New NPM Publisher Account - Rapid Version Publishing - Shell Command Execution in [node-net-pool] index.js: "require("child_process")" - Silent Process Execution in [node-net-pool] index.js: "stdio: "ignore"" - Detached Child Process Payload in [node-net-pool] index.js: "spawn( "reg.exe", [ "ADD", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\..." PAYLOAD FILES [node-net-pool] index.js (+ lib/crypto.js)